EUVD-2026-96759

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-85118

The AI Content Generator Marketing WordPress plugin (versions through 1.0.0 ) is vulnerable to unauthenticated privilege escalation. The root cause is a failure to enforce nonce or capability checks on specific AJAX actions , which allows unauthenticated users to update or delete arbitrary WordPr...

EUVD-2026-96761

The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress...

CVE-2026-84260

The click5 CRM add-on to the Gravity Forms WordPress plugin (versions through 1.0.3 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to sanitize and escape content submitted through an unauthenticated endpoint before it is rendered on an admin page . This vulnera...

CVE-2026-84260 click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-84261 click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored XSS via post_notifications

The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-85118 AI Content Generator Marketing <= 1.0.0 - Unauthenticated Privilege Escalation via Arbitrary Option Update and Deletion

The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site...

EUVD-2026-96757

The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-84251 click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Arbitrary Options Update

The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1. As a result,...

CVE-2026-84253 click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Arbitrary Options Update

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3. As a...

CVE-2026-84258

The click5 CRM add-on for the Ninja Forms WordPress plugin (versions up to and including 1.0.1 ) is vulnerable to Stored XSS . The flaw exists because the application fails to properly sanitize and escape content submitted through an unauthenticated endpoint before displaying it on an admin page....

CVE-2026-84251 click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Arbitrary Options Update

The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1. As a result,...

CVE-2026-84258 click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Stored XSS via post_notifications

The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-84253

The click5 CRM add-on to Gravity Forms WordPress plugin, version 1.0.3 and below , is vulnerable to unauthenticated arbitrary options updates. The root cause is a lack of authorization and CSRF checks when updating options via a REST endpoint , combined with a failure to verify that the option be...

CVE-2026-81649 Fundiin <= 3.4.0 - Unauthenticated Payment Gateway Settings Update and Credential Disclosure

The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is identical on every installation, allowing unauthenticated attackers to disclose the store's payment credentials and customer ord...

EUVD-2026-96752

The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is identical on every installation, allowing unauthenticated attackers to disclose the store's payment credentials and customer ord...

EUVD-2026-96751

The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-81153 Robo Gallery < 5.2.6 - Author+ Stored XSS via Image Overlay Effect Meta

The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputting them in a gallery page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the...

EUVD-2026-96747

The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputting them in a gallery page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the...

CVE-2026-81156 Robo Gallery < 5.2.6 - Contributor+ Stored XSS via Gallery Settings

The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputting them on the gallery edit screen, allowing users with the Contributor role and above to store JavaScript that executes in the context of an administrator who opens the gallery...