CVE-2026-78363 MW WP Form < 5.1.5 - Unauthenticated Arbitrary Shortcode Execution via Completion Message Merge Tags

The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those values into a message that it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site. Exploitation require...

CVE-2026-78363 MW WP Form < 5.1.5 - Unauthenticated Arbitrary Shortcode Execution via Completion Message Merge Tags

The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those values into a message that it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site. Exploitation require...

CVE-2026-74916

WP Fastest Cache WordPress plugin (versions 0.8.7.7 through 1.5.0 ) is vulnerable to unauthenticated cache poisoning via unkeyed tracking parameters. The plugin does not include certain tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing...

CVE-2026-74916 WP Fastest Cache 0.8.7.7 - 1.5.0 - Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters

The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served...

WordPress WP Fastest Cache plugin 0.8.7.7-1.5.0 - Unauthenticated Cache Poisoning vulnerability

Unauthenticated Cache Poisoning vulnerability discovered by Amity Gilmour in WordPress Plugin WP Fastest Cache versions 0.8.7.7-1.5.0...

EUVD-2026-68990

The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served...

CVE-2026-74916 WP Fastest Cache 0.8.7.7 - 1.5.0 - Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters

The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served...

WordPress WPBakery Page Builder plugin <= 8.7.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via 'data' Parameter vulnerability discovered by d.v4ns3c in WordPress Plugin WPBakery Page Builder versions = 8.7.4...

WordPress Welcart e-Commerce plugin <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'customorder' Parameter vulnerability discovered by Afifudin Maarif in WordPress Plugin Welcart e-Commerce versions = 2.12.1...

WordPress Simple Membership plugin <= 4.8.1 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity Binding vulnerability

Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity Binding vulnerability discovered by Kittipat Jitphonchana in WordPress Plugin Simple Membership versions = 4.8.1...

WordPress FS Poster plugin <= 8.0.1 - Authenticated (Subscriber+) Remote Code Execution via FFmpeg Path Setting vulnerability

Authenticated Subscriber+ Remote Code Execution via FFmpeg Path Setting vulnerability discovered by Sullo - Hack LLC in WordPress Plugin FS Poster versions = 8.0.1...

WordPress Live Composer plugin <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via dslcmoduletestimonialsoutput Shortcode vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Page Builder: Live Composer versions = 2.1.19...

WordPress Live Composer plugin <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_projects_output Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via dslcmoduleprojectsoutput Shortcode vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Page Builder: Live Composer versions = 2.1.19...

CVE-2026-75964

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This...

CVE-2026-77189

The Charitable – Donation & Fundraising Platform Donation Forms, Recurring Donations & Fundraising Campaigns plugin for WordPress is vulnerable to generic SQL Injection via 'order' Shortcode Attribute in all versions up to, and including, 1.8.12.1 due to insufficient escaping on the user supplied...

CVE-2026-18488

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute blocksy/dynamic-data in all versions up to, and including, 2.1.51 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-18488

The Blocksy Companion WordPress plugin (versions up to and including 2.1.51 ) is vulnerable to authenticated Stored XSS via the tagName block attribute in the blocksy/dynamic-data block, caused by insufficient input sanitization and output escaping. Attackers with Author-level access or higher ca...

CVE-2026-18488 Blocksy Companion <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data)

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute blocksy/dynamic-data in all versions up to, and including, 2.1.51 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-18488 Blocksy Companion <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data)

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute blocksy/dynamic-data in all versions up to, and including, 2.1.51 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-75980 BetterDocs <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. Thi...