WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by neurotx in WordPress Plugin SureCart versions = 4.9.3...

WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin SureCart versions = 4.9.3...

WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Polylang versions = 3.8.9...

WordPress JetFormBuilder plugin <= 3.6.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Intrudify in WordPress Plugin JetFormBuilder versions = 3.6.6...

WordPress Email Template Customizer for WooCommerce plugin <= 1.3.4 - Content Injection vulnerability

Content Injection vulnerability discovered by cazy in WordPress Plugin Email Template Customizer for WooCommerce versions = 1.3.4...

CVE-2026-107864

The Igor Funa Ad Inserter plugin for WordPress (versions up to and including 2.8.18 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the Improper Neutralization of Input During Web Page Generation . This vulnerability allows an attacker to inject malicious scripts th...

CVE-2026-107864 WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Igor Funa Ad Inserter ad-inserter allows Stored XSS.This issue affects Ad Inserter: from n/a through 2.8.18...

CVE-2026-107864 WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Igor Funa Ad Inserter ad-inserter allows Stored XSS.This issue affects Ad Inserter: from n/a through 2.8.18...

WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin Ad Inserter versions = 2.8.18...

Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE

A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 CVSS score: 10.0, which allows unauthenticated attackers to upload and execute arbitrar...

WordPress JetMenu plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin JetMenu versions = 3.0.5...

WordPress Flexible Subscriptions plugin <= 1.8.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ivan in WordPress Plugin Flexible Subscriptions versions = 1.8.4...

WordPress WP User Manager plugin <= 2.9.22 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Atia Avela in WordPress Plugin WP User Manager versions = 2.9.22...

WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Edge Decor versions = 2.9...

WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme EmojiNation versions = 1.0.12...

WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Gamezone versions = 1.1.11...

CVE-2026-108168 WordPress Custom Query Blocks plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DLX Plugins Custom Query Blocks post-type-archive-mapping allows Stored XSS.This issue affects Custom Query Blocks: from n/a through 5.6.0...

WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Avventure versions = 1.1.12...

WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Bonbon versions = 1.11...

WordPress Custom Query Blocks plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin Custom Query Blocks versions = 5.6.0...