EUVD-2026-52578

The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achiev...

CVE-2026-16623 Create Block Theme < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite)

The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator who holds the capability gating this action but is denied the capability that normally gates PHP file editin...

CVE-2026-16618

The CVE concerns the WordPress plugin Improve SEO (version up to 2.0.11). The vulnerability arises from improper validation of uploaded files: the plugin checks only the file content type while saving the file with an attacker-supplied extension into a publicly accessible directory. This allows u...

EUVD-2026-52579

The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator who holds the capability gating this action but is denied the capability that normally gates PHP file editin...

PT-2026-67665

Name of the Vulnerable Software and Affected Versions The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin versions prior to 1.8.2 Description An unauthenticated user can upload arbitrary files because the plugin fails to validate th...

NPM: Sequelize: SQL Injection (Oracle DB)

NPM: Sequelize: SQL Injection Oracle DB vulnerability discovered by ? in WordPress Npm sequelize versions 6.37.4...

NPM: ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

NPM: ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass vulnerability discovered by ? in WordPress Npm ip-address versions = 10.3.0...

NPM: undici vulnerable to downstream response desynchronization via retry interceptor

NPM: undici vulnerable to downstream response desynchronization via retry interceptor vulnerability discovered by ? in WordPress Npm undici versions 6.28.0...

NPM: Socket.IO: Zero-attachment Memory Exhaustion

NPM: Socket.IO: Zero-attachment Memory Exhaustion vulnerability discovered by ? in WordPress Npm socket.io-parser versions 3.3.6...

NPM: PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

NPM: PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when from is unset vulnerability discovered by ? in WordPress Npm postcss versions = 8.5.22...

WordPress EmbedPress plugin <= 4.5.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin EmbedPress versions = 4.5.6...

WordPress JetEngine plugin <= 3.8.13.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin JetEngine versions = 3.8.13.1...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.14 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by TurboNexic in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.14...

WordPress NextGEN Gallery plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin NextGEN Gallery versions = 4.2.3...

WordPress Forminator plugin <= 1.56.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Forminator versions = 1.56.0...

WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by daroo in WordPress Plugin Forminator versions = 1.56.0...

Exploit for SQL Injection in Wordpress

wpsqli - WordPress SQLi Extractor CVE-2026-60137 A fast,...

CVE-2026-16572

The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks on any page that renders one of the LogMyTrip WordPress plugin through 1.9's shortcodes...

CVE-2026-16565

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify product ownership on its product-attribute REST write endpoints, allowing users with a Dokan vendor account to modify the product attributes and default attributes of any other vendor'...

CVE-2026-16532

The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...