WordPress WPCS plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by JunHee CHO in WordPress Plugin WPCS versions = 1.3.2...

WordPress WP Fast Total Search plugin <= 1.82.284 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by William Honnér in WordPress Plugin WP Fast Total Search versions = 1.82.284...

WordPress WP Docs plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dodoh4t in WordPress Plugin WP Docs versions = 2.3.4...

WordPress BuddyForms plugin <= 2.9.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peng Zhou in WordPress Plugin BuddyForms versions = 2.9.0...

WordPress Groundhogg plugin <= 4.7.1 - Path Traversal vulnerability

Path Traversal vulnerability discovered by Sergei Pro in WordPress Plugin Groundhogg versions = 4.7.1...

WordPress Advanced Product Fields Extended for WooCommerce plugin <= 3.1.6 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Maarten in WordPress Plugin Advanced Product Fields Extended for WooCommerce versions = 3.1.6...

WordPress Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin <= 4.1.22 - Authenticated (Contributor+) Local File Inclusion vulnerability

Authenticated Contributor+ Local File Inclusion vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Event Solution versions = 4.1.22...

WordPress User Access Manager plugin <= 2.3.18 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin User Access Manager versions = 2.3.18...

WordPress FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin <= 3.1.10 - Authenticated (Author+) Remote Code Execution to Privilege Escalation vulnerability

Authenticated Author+ Remote Code Execution to Privilege Escalation vulnerability discovered by Wordfence PRISM in WordPress Plugin FireBox versions = 3.1.10...

WordPress WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin <= 8.7.3 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Ivaylo in WordPress Plugin ChatBot versions = 8.7.3...

CVE-2026-14989

WPLP Cookie Consent (Cookie Banner for GDPR / CCPA) WordPress plugin versions up to and including 4.4.1 are affected by an Unauthenticated Stored Cross-Site Scripting vulnerability in the wpl_user_preference parameter of the consent-logging AJAX endpoint. The root cause is insufficient input sani...

CVE-2026-14359 YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user

The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the adduserinwaitinglist function registered on the wpajaxyithwcwtladduser action being missing both a capability check and a nonce verificatio...

CVE-2026-75927

The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the addPluginCapabilities function unconditionally granting the Editor role...

CVE-2026-15398

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-82223 Reason: This candidate is a reservation duplicate of CVE-2026-82223. Notes: All CVE users should reference CVE-2026-82223 instead of this candidate. All references and descriptions in this candidate have been...

WordPress Repeater Fields for Gravity Forms plugin <= 3.0.4 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by andrea bocchetti in WordPress Plugin Repeater Fields for Gravity Forms versions = 3.0.4...

WordPress Product Filter for WooCommerce by WBW plugin <= 3.4.2 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Yuto Hyakumoto in WordPress Plugin Product Filter by WBW versions = 3.4.2...

CVE-2026-75927 PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant

The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the addPluginCapabilities function unconditionally granting the Editor role...

CVE-2026-17149 myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute

The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute in all versions up to, and including, 3.2.4 due to insufficient input sanitization and output...

CVE-2026-15398

...

CVE-2026-75927

CVE-2026-75927 affects the PublishPress Capabilities WordPress plugin (all versions ≤ 2.50.0 ). The root cause is the addPluginCapabilities() function, which unconditionally grants the Editor role all 15 manage_capabilities_* capabilities via a hard-coded $eligible_roles assignment that executes ...