CVE-2025-2294

🚨 Kubio AI Page Builder = 2.5.1 - Unauthenticated Local File Inclusion 📝 Description The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via the kubiohybridthemeloadtemplate function. This makes it possible for...

EUVD-2026-97730

Cross-Site Request Forgery CSRF vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.9.17...

CVE-2026-108479

The Patreon WordPress plugin (specifically the patreon-connect component) is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability in versions 1.9.17 and below . This flaw allows an attacker to perform unauthorized actions on behalf of a user. The CVSS 3.1 score is 8.1 (High) , indicati...

CVE-2026-108479 WordPress Patreon WordPress plugin <= 1.9.17 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.9.17...

WordPress Patreon WordPress plugin <= 1.9.17 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Asim Alshaya in WordPress Plugin Patreon WordPress versions = 1.9.17...

EUVD-2026-97729

Cross-Site Request Forgery CSRF vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.10.0...

CVE-2026-108481 WordPress Patreon WordPress plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.10.0...

CVE-2026-108481

The Patreon WordPress plugin (patreon-connect) versions

WordPress Patreon WordPress plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by mamgad in WordPress Plugin Patreon WordPress versions = 1.10.0...

WordPress Salevo plugin <= 1.3.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by dcs in WordPress Plugin Salevo versions = 1.3.0...

wp2shell

wp2shell Pre-authentication Remote Code Execution against WordPress Core. Chains CVE-2026-60137 SQLi in authornotin / authorexclude parameter of WPQuery with CVE-2026-63030 REST API batch-route confusion for unauthenticated RCE. Affected Versions Range| Status ---|--- = 6.8.5| Not affected no bat...

WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by hhhai in WordPress Plugin Quiz And Survey Master versions = 11.2.7...

WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin Premium Addons for Elementor versions = 4.11.110...

WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by dzeusking in WordPress Plugin Booktics versions = 1.0.28...

CVE-2026-108478 WordPress Element Pack Elementor Addons plugin <= 8.8.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.8...

WordPress Element Pack Elementor Addons plugin <= 8.8.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin Element Pack Elementor Addons versions = 8.8.8...

CVE-2026-108475

The VideoWhisper.com Broadcast Live Video WordPress plugin (versions

CVE-2026-108476 WordPress Paid Videochat Turnkey Site plugin <= 7.5.13 - Broken Access Control vulnerability

Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.13...

WordPress Broadcast Live Video plugin <= 7.3.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin Broadcast Live Video versions = 7.3.6...

CVE-2017-5487

Installation and Execution of the script 💻 Prerequisites Before starting, make sure you have the following tools installed on your machine: Python 3.x Git pip to manage Python dependencies Installation Steps 1. Clone the repository Use git to clone the repository: git clone...