CVE-2026-102774 SureDash <= 1.12.1 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content in all versions up to, and including, 1.12.1 due to insufficient input sanitization and output escaping. This makes ...

EUVD-2026-96284

The AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

EUVD-2026-96285

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content in all versions up to, and including, 1.12.1 due to insufficient input sanitization and output escaping. This makes ...

CVE-2026-102774

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 1.12.1 . The flaw exists in the Community Post Content due to insufficient input sanitization and output escaping. Specificall...

EUVD-2026-96283

The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via 'displayname' Profile Field Second-Order in all versions up to, and including, 1.5.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

CVE-2026-96765 WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Stored Cross-Site Scripting via 'id_token' Parameter (iss / unique_name JWT claims)

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION WPO365 | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'idtoken' parameter in all versions up to, and including, 44.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-100178 WPAdverts <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via 'adverts_location' Parameter

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'advertslocation' parameter in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2026-96282

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'advertslocation' parameter in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-97396

The Email Marketing for WordPress and WooCommerce – Retainful plugin is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.0.10 . The flaw originates from insufficient input sanitization and output escaping within the 'data' parameter of the /updateOptions REST ...

EUVD-2026-96281

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION WPO365 | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'idtoken' parameter in all versions up to, and including, 44.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-96765

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) in all versions up to and including 44.1 . The root cause is insufficient input sanitization and output escaping of the id_token paramet...

CVE-2026-100178

The WPAdverts – Classifieds Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.3.4 . The root cause is insufficient input sanitization and output escaping specifically involving the 'adverts_location' parameter. This flaw allows unauthent...

EUVD-2026-96280

The Email Marketing for WordPress and WooCommerce – Retainful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

CVE-2026-97396 Email Marketing for WordPress and WooCommerce <= 1.0.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter to /updateOptions REST Endpoint

The Email Marketing for WordPress and WooCommerce – Retainful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

CVE-2026-104803

The WPCOM Member plugin for WordPress (versions up to and including 1.7.27 ) is vulnerable to an Authentication Bypass via the uuid and code parameters of the social-login callback handler. The root cause is a lack of nonce validation, OAuth state verification, and per-visitor namespace isolation...

EUVD-2026-96278

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'attacker-chosen key referenced by the smart tag e.g. "x"' parameter in all versions up to, and including, 2.0.2.1 due ...

CVE-2026-104803 WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback

The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the uuid and code parameters of the social-login callback handler registered on the init hook. The vulnerability exists because the login function's social-login flow...

EUVD-2026-96279

The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the uuid and code parameters of the social-login callback handler registered on the init hook. The vulnerability exists because the login function's social-login flow...

CVE-2026-101921 WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'attacker-chosen key referenced by the smart tag e.g. "x"' parameter in all versions up to, and including, 2.0.2.1 due ...

CVE-2026-100147 FunnelKit <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shippingfirstname' parameter in all versions up to, and including, 3.16.0.5 due to insufficient input sanitization and output escaping. This makes it possible for...