CVE-2026-94421 Church Admin <= 5.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'email' Parameter

The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 5.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2026-94421

The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 5.1.2 . The flaw exists because of insufficient input sanitization and output escaping associated with the 'email' parameter . An authenticated attacker with Subscriber-level a...

CVE-2026-77183 FooSales <= 1.43.0 - Authenticated (Custom+) Privilege Escalation via create_update_customer REST Endpoint

The FooSales – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.43.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes...

EUVD-2026-96102

The FooSales – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.43.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes...

CVE-2026-94375

The Order Export & Order Import for WooCommerce plugin for WordPress (versions

EUVD-2026-96099

The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 7.3 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-96098

The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8 via the getfilepath. This makes it possible for unauthenticated attackers to extract download exported order CSV files containing custom...

CVE-2026-96667

The Real Estate Manager WordPress plugin (versions up to and including 7.3 ) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) . The flaw originates from insufficient input sanitization and output escaping of the 'first_name' parameter. This allows unauthenticated attackers to in...

CVE-2026-94375 Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()

The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8 via the getfilepath. This makes it possible for unauthenticated attackers to extract download exported order CSV files containing custom...

CVE-2026-96667 Real Estate Manager <= 7.3 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter

The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 7.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-96667 Real Estate Manager <= 7.3 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter

The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 7.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-103520 HivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom text attribute user-defined field name' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output...

CVE-2026-104725 Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9 This is due to a missing ownership and capability check on the user parameter within the processedit function, which allows any...

CVE-2026-104763 Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_path' Parameter in media_metadata.json

The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.1 via the 'filepath' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of...

EUVD-2026-96096

The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.1 via the 'filepath' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of...

CVE-2026-103520 HivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom text attribute user-defined field name' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output...

EUVD-2026-96097

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom text attribute user-defined field name' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output...

EUVD-2026-96095

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9 This is due to a missing ownership and capability check on the user parameter within the processedit function, which allows any...

CVE-2026-104725 Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9 This is due to a missing ownership and capability check on the user parameter within the processedit function, which allows any...

CVE-2026-104725

The Groundhogg WordPress plugin (versions up to and including 4.9 ) is vulnerable to Privilege Escalation due to a missing ownership and capability check on the user parameter within the process_edit() function. This flaw allows authenticated users with the edit_contacts capability to reassign a ...