CVE-2026-81660

The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin, in versions prior to 4.5.13 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to validate or escape values submitted to certain optional web form fields (specifically dropdown or radio f...

CVE-2026-76585

The Customer Reviews for WooCommerce WordPress plugin (versions before 5.118.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape the content of customer reviews received via one of the plugin's endpoints, specifically involving th...

WordPress SOGO Add Script to Individual Pages Header Footer plugin <= 3.9 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Chamseddine Bouzaiene in WordPress Plugin SOGO Add Script to Individual Pages Header Footer versions = 3.9...

CVE-2026-14835 SOGO Add Script to Individual Pages Header Footer <= 3.9 - Contributor+ Stored XSS via Post Metabox

The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfilteredhtml capability, allowing users with contributor-level access a...

EUVD-2026-68154

The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfilteredhtml capability, allowing users with contributor-level access a...

CVE-2026-14835

The SOGO Add Script to Individual Pages Header Footer WordPress plugin (versions prior to 4.0 ) contains a Stored Cross-Site Scripting (XSS) vulnerability. The plugin fails to sanitize or escape custom header and footer script values saved via the post metabox and does not restrict these actions ...

CVE-2026-15980

The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the sendlink AJAX handler and improper token validation in the activate function. This makes it possible for unauthenticated attackers t...

Exploit for CVE-2026-82222

CVE-2026-82222 — GiveWP Marker-Only RCE Validation Lab Privat...

CVE-2026-15980 MyHome Core <= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token

The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the sendlink AJAX handler and improper token validation in the activate function. This makes it possible for unauthenticated attackers t...

EUVD-2026-68149

The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the sendlink AJAX handler and improper token validation in the activate function. This makes it possible for unauthenticated attackers t...

PT-2026-83523

Name of the Vulnerable Software and Affected Versions SOGO Add Script to Individual Pages Header Footer versions prior to 4.0 Description The plugin fails to sanitize or escape custom header and footer script values saved via the post metabox. Additionally, it does not restrict these actions to...

CVE-2026-78364: Improper Neutralization of Input During Web Page Generation

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admi...

CVE-2026-19722: Improper Limitation of a Pathname to a Restricted Directory

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can...

PT-2026-83526

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admi...

PT-2026-83528

The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute...

PT-2026-83520

Name of the Vulnerable Software and Affected Versions MyHome Core versions prior to 4.4.6 Description An authentication bypass exists in the MyHome Core plugin for WordPress. The issue stems from missing authorization in the send link AJAX handler and improper token validation within the activate...

CVE-2026-81660: Improper Neutralization of Input During Web Page Generation

The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.5.13 does not validate or escape values submitted to some optional web form fields before storing them and outputting them back in an administrative area, allowing unauthenticated users to perform Stored...

PT-2026-83527

The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.5.13 does not validate or escape values submitted to some optional web form fields before storing them and outputting them back in an administrative area, allowing unauthenticated users to perform Stored...

PT-2026-83525

The Customer Reviews for WooCommerce WordPress plugin before 5.118.0 does not sanitise and escape the content of customer reviews received via one of its endpoints, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks...

CVE-2023-43340

creationtimestamp| type| source ---|---|--- 2026-08-29 23:00:18+00:00| seen| Telegram/mygM17KSjyX1ytBX-vC2bUSC6Quyw0MIzjWP6u1Kpz11D0 2026-08-29 23:00:18+00:00| seen| Telegram/tcvPlgy4RT-8DYuUczCHAOelno4AcU1hpFFn5ph0Pb3yXE 2026-08-30 00:00:26+00:00| seen|...