WordPress Download Manager plugin <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure vulnerability

Authenticated Subscriber+ Sensitive Information Exposure vulnerability discovered by Sawyer in WordPress Plugin Download Manager versions = 3.3.71...

WordPress Testimonials by BestWebSoft plugin 1.0.5-1.0.8 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Testimonials by BestWebSoft versions 1.0.5-1.0.8...

WordPress UnitechPay plugin <= 1.0.6.3 - Unauthenticated Order Payment Bypass vulnerability

Unauthenticated Order Payment Bypass vulnerability discovered by Timur in WordPress Plugin UnitechPay versions = 1.0.6.3...

WordPress FooSales plugin < 1.43.3 - Cashier+ Privilege Escalation vulnerability

Cashier+ Privilege Escalation vulnerability discovered by Naoki Kawahigashi in WordPress Plugin FooSales versions 1.43.3...

WordPress Advanced Classifieds & Directory Pro plugin <= 3.4.4 - Authenticated (Custom+) Stored Cross-Site Scripting vulnerability

Authenticated Custom+ Stored Cross-Site Scripting vulnerability discovered by Ivaylo in WordPress Plugin Advanced Classifieds & Directory Pro versions = 3.4.4...

CVE-2026-94064

Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme neocut allows Object Injection.This issue affects Neo | Barber Shop WordPress Theme: from n/a through 3.5...

CVE-2026-94066 WordPress Pond theme <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SpabRice Pond pond allows Reflected XSS.This issue affects Pond: from n/a through 2.6.1...

EUVD-2026-95784

Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme neocut allows Object Injection.This issue affects Neo | Barber Shop WordPress Theme: from n/a through 3.5...

CVE-2026-94064 WordPress Neo | Barber Shop WordPress Theme theme <= 3.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme neocut allows Object Injection.This issue affects Neo | Barber Shop WordPress Theme: from n/a through 3.5...

CVE-2026-94064

The BuddhaThemes Neo | Barber Shop WordPress Theme (neocut) is vulnerable to PHP Object Injection due to the Deserialization of Untrusted Data (CWE-502). This vulnerability affects versions up to and including 3.5 . Successful exploitation can lead to significant impacts on confidentiality , inte...

WordPress Dashboard Notes plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by JunHee CHO in WordPress Plugin Dashboard Notes versions = 1.0.3...

CVE-2026-94058 WordPress Treck theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bracketweb Treck treck allows Reflected XSS.This issue affects Treck: from n/a through 1.0.0...

CVE-2026-94060

The Bracketweb Voldor WordPress theme (versions

CVE-2026-94058

The Bracketweb Treck WordPress theme (versions

WordPress Team Section Block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Asim Alshaya in WordPress Plugin Team Section Block versions = 2.0.4...

WordPress StreamCast plugin <= 2.4.5 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Asim Alshaya in WordPress Plugin StreamCast versions = 2.4.6...

WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Document Embedder versions = 2.4.0...

WordPress DirectoryPress plugin <= 3.6.27 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by 0xzenko in WordPress Plugin DirectoryPress versions = 3.6.27...

WordPress uListing plugin <= 2.2.0 - Settings Change vulnerability

Settings Change vulnerability discovered by Jakub Herman in WordPress Plugin uListing versions = 2.2.0...

WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Before After Image Comparison – Image comparison for WP versions = 1.1.21...