EUVD-2026-96781

The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

CVE-2026-89234 WP-Partner <= 1.2.1 - Unauthenticated SQLi via 'id' Parameter

The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database...

CVE-2026-89283 WP Posts Password Batch Manager <= 1.1 - Unauthenticated Bulk Post Password Rewrite

The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite the password of every published post, disclosing...

CVE-2026-89285 Datalist it <= 0.0.3 - Unauthenticated SQLi via dli_fronted_action

The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...

CVE-2026-89214 WpCues Basic Quiz <= 1.6.5 - Unauthenticated SQLi via Quiz Result Submission

The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

CVE-2026-89214 WpCues Basic Quiz <= 1.6.5 - Unauthenticated SQLi via Quiz Result Submission

The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

CVE-2026-89213 Llavero.io <= 0.1.4 - Unauthenticated Blind SQLi via 'cill_login' Parameter

The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

CVE-2026-88827 Disable Users <= 1.0.5 - Disabled Account Authentication Bypass via XML-RPC and Application Passwords

The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with the account's full privileges...

CVE-2026-88903

The Topcontent WordPress plugin versions through 1.2.1 is vulnerable to an unauthenticated stored XSS via a content webhook. The root cause is improper authorization of a request handler combined with the disabling of HTML sanitisation before storing submitted content. This allows unauthenticated...

CVE-2026-88827

The Disable Users WordPress plugin (versions through 1.0.5 ) contains a vulnerability where account-disabling controls are not enforced across all authentication paths. This allows users whose accounts have been disabled by an administrator to bypass the restriction and continue authenticating wi...

EUVD-2026-96780

The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

EUVD-2026-96779

The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks...

EUVD-2026-96777

The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector...

EUVD-2026-96776

The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted content, allowing unauthenticated attackers to publish arbitrary posts containing malicious JavaScript on any site where its API key ha...

CVE-2026-89195 Site Setup Wizard <= 1.5.8 - Unauthenticated SQLi via ssw_check_admin_email_exists

The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

CVE-2026-88827 Disable Users <= 1.0.5 - Disabled Account Authentication Bypass via XML-RPC and Application Passwords

The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with the account's full privileges...

CVE-2026-88903 Topcontent <= 1.2.1 - Unauthenticated Stored XSS via Content Webhook

The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted content, allowing unauthenticated attackers to publish arbitrary posts containing malicious JavaScript on any site where its API key ha...

CVE-2026-88930

The Social Web Suite WordPress plugin (versions through 4.1.12 ) is vulnerable to SQL injection attacks. The root cause is twofold: the plugin fails to require a shared secret before accepting authorized requests, and it fails to properly sanitise and escape a parameter used in an SQL statement. ...

EUVD-2026-96775

The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with the account's full privileges...

CVE-2026-88903 Topcontent <= 1.2.1 - Unauthenticated Stored XSS via Content Webhook

The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted content, allowing unauthenticated attackers to publish arbitrary posts containing malicious JavaScript on any site where its API key ha...