CVE-2026-94415 WordPress Betheme theme <= 28.5.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Muffingroup Betheme betheme allows Reflected XSS.This issue affects Betheme: from n/a through 28.5.8...

CVE-2026-96671

The fifu.app Featured Image from URL WordPress plugin is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability in versions up to and including 6.0.7 . This flaw allows an attacker to perform unauthorized actions by tricking a victim's browser into making unintended requests. The severit...

CVE-2026-96671 WordPress Featured Image from URL plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross Site Request Forgery.This issue affects Featured Image from URL: from n/a through 6.0.7...

CVE-2026-96331

The wpdreams Ajax Search Pro WordPress plugin (versions 4.29.1 and below ) is vulnerable to a Blind SQL Injection flaw. This issue is caused by the improper neutralization of special elements used in SQL commands. An attacker could exploit this to interact with the database. No specific remediati...

CVE-2026-95597 WordPress 워드프레스 결제 심플페이 plugin <= 5.5.17 - Settings Change vulnerability

Missing Authorization vulnerability in codemstory 워드프레스 결제 심플페이 pgall-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 워드프레스 결제 심플페이: from n/a through 5.5.17...

CVE-2026-96461

The WordPress Amelia plugin (versions

CVE-2026-96461 WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10...

CVE-2026-96539

The Ultimate Member WordPress plugin (versions

CVE-2026-96337 WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through 4.17.3...

CVE-2026-84224

The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are not otherwise reachable, and to tell which of those are live from the respons...

WordPress JetBlocks For Elementor plugin <= 1.5.2.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin JetBlocks For Elementor versions = 1.5.2.1...

CVE-2025-14123

The Redux Framework plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.5.11. This is due to the plugin saving arbitrary meta keys under a registered option name without sufficient capability checks or key allowlist / restrictions. This makes it...

CVE-2026-84220 Kirki < 6.3.2 - Unauthenticated Arbitrary Shortcode Execution via Comments Collection

The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders them, and displays comments regardless of their moderation status, allowing unauthenticated visitors to run shortcodes registered on the site and to read private custom fields ...

CVE-2026-84224

The Kirki WordPress plugin versions prior to 6.3.2 is vulnerable to a Blind SSRF flaw. The issue exists because the plugin fails to validate the host of a URL provided via a Remote Template URL before fetching it. This allows users with editor-level access or higher to force the site to issue req...

EUVD-2026-95577

The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are not otherwise reachable, and to tell which of those are live from the respons...

EUVD-2026-95576

The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders them, and displays comments regardless of their moderation status, allowing unauthenticated visitors to run shortcodes registered on the site and to read private custom fields ...

CVE-2026-84220

The Kirki WordPress plugin prior to version 6.3.2 is vulnerable to unauthenticated arbitrary shortcode execution . The issue occurs because the plugin fails to prevent the execution of shortcodes contained within comments when they are rendered, and it displays these comments regardless of their ...

CVE-2026-84224 Kirki < 6.3.2 - Editor+ Blind SSRF via Remote Template URL

The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are not otherwise reachable, and to tell which of those are live from the respons...

WordPress Kirki plugin < 6.3.2 - Editor+ Blind SSRF vulnerability

Editor+ Blind SSRF vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Kirki versions 6.3.2...

CVE-2025-14123

The Redux Framework plugin for WordPress (versions up to and including 4.5.11 ) is vulnerable to privilege escalation . The root cause is the plugin saving arbitrary meta keys under a registered option name without sufficient capability checks or key allowlist restrictions. This allows authentica...