EUVD-2026-51689

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.0 via the processAttachment function. This makes it possible for unauthenticated attackers to read the...

EUVD-2026-51686

The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headingWrapper' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possibl...

CVE-2026-7623

The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headingWrapper' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possibl...

CVE-2026-7623 SureForms <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingWrapper' Block Attribute

The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headingWrapper' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possibl...

CVE-2026-7623

CVE-2026-7623 - SureForms WordPress plugin : Affects SureForms – Contact Form, Payment Form & Other Custom Form Builder for WordPress, vulnerable in all versions up to and including 2.8.1. The issue is a Stored Cross-Site Scripting via the headingWrapper parameter caused by insufficient input san...

PT-2026-67051

The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished draft, pending, private, and...

PT-2026-67342

The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin's Apple login handler accepting the Apple id token and decoding only its base64 payload without verifying the JWT signature against Apple...

PT-2026-67027

The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewp get svg content' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...

PT-2026-67131

The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.15 via the 'uamgetfile' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...

CVE-2026-54768 WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This...

CVE-2026-54768 WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This...

CVE-2026-54768

WPGraphQL

WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

Summary The sendPasswordResetEmail mutation in WPGraphQL is explicitly designed to prevent user enumeration. The resolver in src/Mutation/SendPasswordResetEmail.php states in a code comment: // We obsfucate the actual success of this mutation to prevent user enumeration. The mutation always retur...

NPM: Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier

NPM: Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier vulnerability discovered by ? in WordPress Npm jodit versions 4.12.28...

NPM: Jodit has prototype pollution via Jodit.configure() / ConfigMerge

NPM: Jodit has prototype pollution via Jodit.configure / ConfigMerge vulnerability discovered by ? in WordPress Npm jodit versions 4.12.18...

NPM: dssrf: any users using 1.1.1.1 DNS is impacted by SSRF

NPM: dssrf: any users using 1.1.1.1 DNS is impacted by SSRF vulnerability discovered by ? in WordPress Npm dssrf versions = 1.0.4...

NPM: re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)

NPM: re2: Out-of-bounds heap read in exec/test/match via attacker-influenced lastIndex on a non-ASCII subject → uncatchable process crash DoS vulnerability discovered by ? in WordPress Npm re2 versions = 1.25.1...

CVE-2026-28144

The CVE-2026-28144 entry concerns the WordPress WP Maps plugin by Flipper Code, affected up to version 4.9.6. It describes an issue titled “Insertion of Sensitive Information Into Sent Data,” enabling retrieval of embedded sensitive data. The available metrics indicate a CVSS 3.1 base score of 4....

CVE-2026-28145

The CVE-2026-28145 entry identifies a broken access control vulnerability in the WordPress plugin MasterStudy LMS (StylemixThemes) affecting versions up to 3.7.39. The issue is described as Insufficient Verification of Data Authenticity, allowing an attacker to manipulate a user’s state. Public r...

CVE-2026-18436

The MailPress plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.5.0 via the campaign revision-restore REST endpoint POST /wp-json/mailpress/v1/campaign//restore-revision/. The route in the vulnerable range was registered without a permissionCallback,...