WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin Bus Ticket Booking with Seat Reservation versions = 5.9.7...

WordPress JetProductTables plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by jydae in WordPress Plugin JetProductTables versions = 1.2.4...

WordPress Broadcast Live Video plugin <= 7.3.2 - Session Hijacking vulnerability

Session Hijacking vulnerability discovered by Peter Tang in WordPress Plugin Broadcast Live Video versions = 7.3.2...

WordPress Frontend Dashboard plugin <= 3.0.7 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Đỗ Trung Kiên in WordPress Plugin Frontend Dashboard versions = 3.0.7...

WordPress Marin theme <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Theme Marin versions = 0.1.1...

WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by neurotx in WordPress Plugin SureCart versions = 4.9.3...

WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin SureCart versions = 4.9.3...

WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Polylang versions = 3.8.9...

WordPress JetFormBuilder plugin <= 3.6.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Intrudify in WordPress Plugin JetFormBuilder versions = 3.6.6...

WordPress Email Template Customizer for WooCommerce plugin <= 1.3.4 - Content Injection vulnerability

Content Injection vulnerability discovered by cazy in WordPress Plugin Email Template Customizer for WooCommerce versions = 1.3.4...

CVE-2024-51818

CVE-2024-51818 Fancy Product Designer = 6.4.3 - Unauthenticated SQL Injection Description The Fancy Product Designer plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 6.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-107864 WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Igor Funa Ad Inserter ad-inserter allows Stored XSS.This issue affects Ad Inserter: from n/a through 2.8.18...

CVE-2026-107864 WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Igor Funa Ad Inserter ad-inserter allows Stored XSS.This issue affects Ad Inserter: from n/a through 2.8.18...

CVE-2026-107864

The Igor Funa Ad Inserter plugin for WordPress (versions up to and including 2.8.18 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the Improper Neutralization of Input During Web Page Generation . This vulnerability allows an attacker to inject malicious scripts th...

WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin Ad Inserter versions = 2.8.18...

Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE

A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 CVSS score: 10.0, which allows unauthenticated attackers to upload and execute arbitrar...

WordPress JetMenu plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin JetMenu versions = 3.0.5...

WordPress Flexible Subscriptions plugin <= 1.8.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ivan in WordPress Plugin Flexible Subscriptions versions = 1.8.4...

WordPress WP User Manager plugin <= 2.9.22 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Atia Avela in WordPress Plugin WP User Manager versions = 2.9.22...

CVE-2026-108168 WordPress Custom Query Blocks plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DLX Plugins Custom Query Blocks post-type-archive-mapping allows Stored XSS.This issue affects Custom Query Blocks: from n/a through 5.6.0...