CVE-2026-66702 WordPress Rank Math SEO plugin <= 1.0.274.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Rank Math SEO = 1.0.274.1 versions...

CVE-2026-66703

CVE-2026-66703 describes a Contributor Cross Site Scripting (XSS) vulnerability in the WordPress MailOptin plugin versions

CVE-2026-66703 WordPress MailOptin plugin <= 1.2.78.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in MailOptin = 1.2.78.0 versions...

CVE-2026-66702

CVE-2026-66702 affects the WordPress Rank Math SEO plugin up to version 1.0.274.1 and is described as an unauthenticated Cross Site Scripting (XSS) vulnerability. The connected documents confirm the vulnerability exists in Rank Math SEO

CVE-2026-66701 WordPress Profile Builder plugin <= 3.16.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Profile Builder = 3.16.5 versions...

CVE-2026-66701

CVE-2026-66701 affects the WordPress Profile Builder plugin (versions

CVE-2026-66701 WordPress Profile Builder plugin <= 3.16.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Profile Builder = 3.16.5 versions...

CVE-2026-66699 WordPress Dokan plugin <= 5.0.10 - Broken Access Control vulnerability

Custom role Broken Access Control in Dokan = 5.0.10 versions...

CVE-2026-66699

CVE-2026-66699 concerns WordPress Dokan plugin (versions

CVE-2026-66696

The CVE-2026-66696 entry concerns the WordPress Kadence Blocks plugin (Gutenberg Blocks) versions

CVE-2026-66695 WordPress W3 Total Cache plugin <= 2.10.2 - Path Traversal vulnerability

Unauthenticated Path Traversal in W3 Total Cache = 2.10.2 versions...

CVE-2026-66695

The CVE-2026-66695 entry describes an Unauthenticated Path Traversal in the WordPress W3 Total Cache plugin, affecting versions &lt;= 2.10.2. The vulnerability is active across plugin components implementing file/path access, with CVSS 3.1 base metrics indicating NETWORK attack vector, no user in...

CVE-2026-66692 WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Insecure Direct Object References (IDOR) vulnerability

Customer Insecure Direct Object References IDOR in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...

CVE-2026-66694 WordPress Thrive Architect plugin <= 10.9.3.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Thrive Architect = 10.9.3.1 versions...

EUVD-2026-53899

Unauthenticated Cross Site Scripting XSS in GiveWP = 4.16.5 versions...

CVE-2026-66690

The following CVE pertains to the WordPress GiveWP plugin: Unauthenticated Cross Site Scripting (XSS) in GiveWP versions

CVE-2026-66690 WordPress GiveWP plugin <= 4.16.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in GiveWP = 4.16.5 versions...

CVE-2026-66688 WordPress Ultimate Addons for Elementor plugin <= 1.45.2 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Ultimate Addons for Elementor = 1.45.2 versions...

CVE-2026-66688

The CVE-2026-66688 entry concerns a Contributor Cross Site Scripting (XSS) vulnerability in the WordPress plugin Ultimate Addons for Elementor , affected in versions

CVE-2026-66686

Summary: CVE-2026-66686 is an Unauthenticated CSRF vulnerability in the WordPress plugin Plugins Garbage Collector (Database Cleanup) , affecting versions ≤ 0.14. The vulnerability is described as unauthenticated CSRF, implying an attacker could induce actions on behalf of a user without requirin...