EUVD-2026-53710

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the...

EUVD-2026-53703

The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function in all versions from 6.0 - 6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to read and delete arbitrar...

CVE-2026-15991 File Manager 6.0 - 6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read and Deletion via 'cmd' Query Parameter

The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function in all versions from 6.0 - 6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to read and delete arbitrar...

CVE-2026-15991

The File Manager WordPress plugin (versions 6.0–6.9) is affected by an access control flaw in its elFinder integration. Insufficient file path validation in the connector allows an authenticated user with subscriber-level access or higher to read and delete arbitrary server files via a cmd parame...

EUVD-2026-53702

The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name to.name in Email Logs in all versions up to, and including, 2.2.95 due to insufficient input...

CVE-2026-16636 FluentSMTP <= 2.2.95 - Unauthenticated Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs

The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name to.name in Email Logs in all versions up to, and including, 2.2.95 due to insufficient input...

PT-2026-68882

Name of the Vulnerable Software and Affected Versions WordPress affected versions not specified Description WordPress is subject to a pre-authentication reflected cross-site scripting XSS issue on the login screen. This allows an attacker to execute arbitrary JavaScript in the site origin without...

WP < 7.0.3 - Subscriber+ Email Change Confirmation Bypass

Description WordPress does not always validate a new email address consistently when a profile is updated, which could allow any authenticated user to change their account email address without completing the ownership confirmation step...

NPM: Nuxt: Unauthorized Component Instantiation via Server Island Props

NPM: Nuxt: Unauthorized Component Instantiation via Server Island Props vulnerability discovered by ? in WordPress Npm nuxt versions = 3.1.0, 3.21.10...

Exploit for Interpretation Conflict in Wordpress

wp2shell — WordPress Core Pre-Auth RCE CVE-2026-63030 Ba...

NPM: Electron: Sandboxed iframes can launch external protocol handlers

NPM: Electron: Sandboxed iframes can launch external protocol handlers vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...

NPM: Electron: contextBridge object copy honors prototype setters

NPM: Electron: contextBridge object copy honors prototype setters vulnerability discovered by ? in WordPress Npm electron versions 39.8.9...

NPM: Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

NPM: Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path vulnerability discovered by ? in WordPress Npm electron versions 39.8.10...

WordPress Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider plugin <= 3.111.0 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by haofanjiukunle in WordPress Plugin Responsive Slider by MetaSlider versions = 3.111.0...

NPM: Electron: window.open features string controls some window options considered privileged

NPM: Electron: window.open features string controls some window options considered privileged vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...

NPM: Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

NPM: Electron: ProtocolResponse.url reuses the default session cache instead of the registering session vulnerability discovered by ? in WordPress Npm electron versions = 40.0.0-alpha.1, 40.10.6...

NPM: Electron: HTTP redirect followed into local file loader

NPM: Electron: HTTP redirect followed into local file loader vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...

NPM: Electron: Extension tab APIs operate across session boundaries

NPM: Electron: Extension tab APIs operate across session boundaries vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...

NPM: Electron: shell.openPath path validation bypass via embedded null byte

NPM: Electron: shell.openPath path validation bypass via embedded null byte vulnerability discovered by ? in WordPress Npm electron versions 39.8.6...

NPM: Electron: Context isolation bypass via Function.prototype.bind hijack

NPM: Electron: Context isolation bypass via Function.prototype.bind hijack vulnerability discovered by ? in WordPress Npm electron versions 39.8.9...