EUVD-2026-52593

The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitise...

CVE-2026-15958

The CVE-2026-15958 entry affects the WordPress plugin Easy Integration for Dropbox (before 2.2.0). The vulnerability arises from missing authorization checks on several file-management AJAX actions that are exposed to unauthenticated users, enabling an attacker to perform unauthenticated actions ...

CVE-2026-14848

The CVE-2026-14848 entry concerns the Paid Memberships Subscriptions WordPress plugin (versions prior to 3.0.8). The vulnerability arises in the change-subscription checkout: an authenticated user with Subscriber-level access (or higher) cannot reliably verify that the subscription being modified...

EUVD-2026-52589

The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allowing users with the Editor role or Contributor/Author when the Nested Pages WordPress plugin before 3.2.15 is enabled for the...

CVE-2026-14939

CVE-2026-14939 affects the Visualizer: Tables and Charts Manager WordPress plugin, vulnerable before version 4.0.6. The issue arises because a user-supplied URL is not restricted to safe address ranges when fetched server-side, enabling a Contributor+ user to perform a server-side request forgery...

EUVD-2026-52588

The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched...

CVE-2026-14872

CVE-2026-14872 affects the WordPress plugin family “Database for Contact Form 7, WPforms, Elementor forms” (pre-1.5.5). The issue arises because the plugin does not properly sanitize or escape the id parameter before using it in an SQL statement, enabling an SQL Injection. Exploitation is possibl...

EUVD-2026-52587

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default...

EUVD-2026-52586

The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-subscription checkout belongs to the current user, allowing any authenticated user with Subscriber-level access and above to take over another member's...

EUVD-2026-52582

The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its unauthenticated AJAX actions: when the MonsterInsights WordPress plugin before 11.1.0 is not connected to Google Analytics the HMAC signing key is empty, which lets unauthenticated attackers...

EUVD-2026-52584

The GDPR Framework By Data443 WordPress plugin before 2.4.0 does not properly verify authorization or the identity of the data subject when recording cookie-consent choices and privacy requests, allowing unauthenticated attackers to forge consent records for arbitrary email addresses and to flood...

EUVD-2026-52581

The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation doe...

CVE-2026-14816

The GDPR Framework WordPress plugin prior to 2.4.0 allows unauthenticated attackers to forge consent records for arbitrary emails and flood the privacy-request queue due to improper authorization/identity verification when recording cookie-consent choices and privacy requests. Upgrade to version ...

EUVD-2026-52585

The Quiz and Survey Master QSM WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing th...

CVE-2026-16623

The CVE-2026-16623 entry describes a PHP code-injection flaw in the Create Block WordPress plugin prior to 2.10.0. A multisite subsite administrator (with limited PHP file-edit capability) can inject and execute arbitrary PHP because user-supplied text isn’t properly escaped before being written ...

CVE-2026-16536

The CVE-2026-16536 entry concerns the Simple Google Calendar Outlook Events Widget WordPress plugin before version 3.1.0. The vulnerability arises because the plugin does not validate a user-supplied URL before performing a server-side request, enabling unauthenticated attackers to perform Server...

EUVD-2026-52580

The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal...

CVE-2026-16618

CVE-2026-16618 affects the ImproveSEO WordPress plugin up to version 2.0.11. The vulnerability arises from improper validation of uploaded files: the plugin only checks file content type while writing the file with the attacker-supplied extension to a publicly accessible directory, enabling unaut...

EUVD-2026-52579

The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator who holds the capability gating this action but is denied the capability that normally gates PHP file editin...

EUVD-2026-52578

The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achiev...