CVE-2026-81297 WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81296 WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81297 WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81290

CVE-2026-81290 is an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress plugin Email Subscribers & Newsletters , affecting versions ≤ 5.9.33 . The vulnerability was discovered by Jiemook and rated CVSS 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicat...

CVE-2026-81290 WordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Email Subscribers & Newsletters = 5.9.33 versions...

CVE-2026-82852 WordPress MapSVG plugin <= 8.15.0 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery SSRF in MapSVG = 8.15.0 versions...

CVE-2026-82852 WordPress MapSVG plugin <= 8.15.0 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery SSRF in MapSVG = 8.15.0 versions...

CVE-2026-81280 WordPress Print Barcode Labels for your WooCommerce products/orders plugin <= 4.0.0 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders = 4.0.0 versions...

WordPress WCFM Marketplace plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WCFM Marketplace versions = 3.8.2...

WordPress Pods plugin 3.3-3.3.9.1 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Unknown in WordPress Plugin Pods versions 3.3-3.3.9.1...

WordPress User Profile Builder plugin <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'email' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Profile Builder versions = 4.0.0...

WordPress Blocksy Companion plugin <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data) vulnerability

Authenticated Author+ Stored Cross-Site Scripting via 'tagName' Block Attribute blocksy/dynamic-data vulnerability discovered by haofanjiukunle in WordPress Plugin Blocksy Companion versions = 2.1.51...

WordPress BetterDocs plugin <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin BetterDocs versions = 4.8.1...

WordPress Support Genix plugin <= 1.4.52 - Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Token vulnerability

Authenticated Subscriber+ Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Token vulnerability discovered by Supakiad S. m3ez - E-CQURITY Thailand in WordPress Plugin Support Genix versions = 1.4.52...

WordPress Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin <= 5.8.1 - Unauthenticated Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'lsddisplstyle' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Listdom versions = 5.8.1...

WordPress Affiliate Super Assistent plugin <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via ‘doCommentShortcode’ function vulnerability

Unauthenticated Stored Cross-Site Scripting via ‘doCommentShortcode’ function vulnerability discovered by theviper17y in WordPress Plugin Affiliate Super Assistent versions = 1.10.2...

WordPress Oxygen plugin 6.0-6.1.1 - Unauthenticated Broken Access Control in Design Library Import vulnerability

Unauthenticated Broken Access Control in Design Library Import vulnerability discovered by Soflyy in WordPress Plugin Oxygen Builder versions 6.0-6.1.1...

WordPress Shopping Cart & eCommerce Store plugin <= 5.9.2 - Authenticated (Administrator+) SQL Injection via 'product_order' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 'productorder' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WP EasyCart versions = 5.9.2...

CVE-2026-75133

Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed kbdcronprocess parameter without authentication. Attackers can predict the...

WordPress Photo Gallery by Ays plugin <= 6.8.2 - Authenticated (Administrator+) SQL Injection via 's' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 's' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Photo Gallery by Ays versions = 6.8.2...