CVE-2026-108168 WordPress Custom Query Blocks plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DLX Plugins Custom Query Blocks post-type-archive-mapping allows Stored XSS.This issue affects Custom Query Blocks: from n/a through 5.6.0...

WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Avventure versions = 1.1.12...

WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Bonbon versions = 1.11...

WordPress Custom Query Blocks plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin Custom Query Blocks versions = 5.6.0...

WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Coinpress versions = 1.0.15...

CVE-2023-25996 WordPress Booster Elite for WooCommerce plugin < 8.4.0 - Authenticated Arbitrary WordPress Option Disclosure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Pluggabl LLC. Booster Elite for WooCommerce booster-elite-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Booster Elite for WooCommerce: from n/a before 8.4.0...

CVE-2023-25996

The Booster Elite for WooCommerce plugin by Pluggabl LLC is vulnerable to an Authenticated Arbitrary WordPress Option Disclosure vulnerability in versions prior to 8.4.0 . This issue allows an authenticated user to retrieve embedded sensitive data from the WordPress options table. The root cause ...

CVE-2023-25996 WordPress Booster Elite for WooCommerce plugin < 8.4.0 - Authenticated Arbitrary WordPress Option Disclosure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Pluggabl LLC. Booster Elite for WooCommerce booster-elite-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Booster Elite for WooCommerce: from n/a before 8.4.0...

WordPress Booster Elite for WooCommerce plugin < 8.4.0 - Authenticated Arbitrary WordPress Option Disclosure vulnerability

Authenticated Arbitrary WordPress Option Disclosure vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Booster Elite for WooCommerce versions 8.4.0...

CVE-2026-107432

The WordPress Event post plugin (versions

CVE-2026-107432 WordPress Event post plugin <= 6.1.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1...

CVE-2026-107432 WordPress Event post plugin <= 6.1.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1...

WordPress TMDS plugin <= 1.0.15 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Aarush Gaur in WordPress Plugin TMDS versions = 1.0.15...

CVE-2026-107429

The WordPress Paid Videochat Turnkey Site (ppv-live-webcams) plugin is vulnerable to an Improper Validation of Specified Quantity in Input vulnerability (CWE-1284) in versions up to and including 7.5.12 . This flaw allows for Input Data Manipulation . While the specific component or function is n...

CVE-2026-107429 WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Other vulnerability Type vulnerability

Improper Validation of Specified Quantity in Input vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Input Data Manipulation.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12...

CVE-2026-107429 WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Other vulnerability Type vulnerability

Improper Validation of Specified Quantity in Input vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Input Data Manipulation.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12...

CVE-2026-107427

The WordPress Event post plugin, affecting versions

WordPress Event post plugin <= 6.1.1 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by genisis-lab in WordPress Plugin Event post versions = 6.1.1...

WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Other vulnerability Type vulnerability

Other vulnerability Type vulnerability discovered by Erik Debye in WordPress Plugin Paid Videochat Turnkey Site versions = 7.5.12...

WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Erik Debye in WordPress Plugin Paid Videochat Turnkey Site versions = 7.5.12...