WordPress Kali Forms plugin <= 2.4.27 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by mroccon in WordPress Plugin Kali Forms versions = 2.4.27...

WordPress Video Gallery Block plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Harry Nguyen in WordPress Plugin Video Gallery Block versions = 1.6.0...

WordPress Cozy Blocks plugin <= 2.2.27 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin Cozy Blocks versions = 2.2.27...

WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Oly Hossen in WordPress Plugin Kali Forms versions = 2.4.27...

WordPress Site Reviews plugin <= 8.3.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Plugin Site Reviews versions = 8.3.5...

CVE-2026-118094

The Ad Inserter WordPress plugin (versions up to and including 2.8.18 ) is vulnerable to Stored Cross-Site Scripting (XSS) . This issue stems from the Improper Neutralization of Input During Web Page Generation , allowing an attacker to inject malicious scripts that are subsequently stored and ex...

CVE-2026-118094 WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Igor Funa Ad Inserter ad-inserter allows Stored XSS.This issue affects Ad Inserter: from n/a through 2.8.18...

WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Deva Parekh in WordPress Plugin Ad Inserter versions = 2.8.18...

CVE-2026-118093

The WordPress Product Feed Manager plugin (best-woocommerce-feed) is affected by a Missing Authorization vulnerability in versions up to 7.14.1 . This flaw allows for the exploitation of Incorrectly Configured Access Control Security Levels , resulting in broken access control. The documents do n...

WordPress JetEngine plugin <= 3.9.0.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ayukiab in WordPress Plugin JetEngine versions = 3.9.0.1...

WordPress Product Feed Manager plugin <= 7.14.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by mroccon in WordPress Plugin Product Feed Manager versions = 7.14.1...

CVE-2026-92086

The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.7 via the 'postid' parameter. This makes it possible for unauthenticated attackers to extract personally identifiable information from other users' form inquiry records,...

CVE-2026-96767

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 9.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...

CVE-2026-115821

The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billingfirstname, billinglastname' parameter in all versions up to, and including, 3.7.29 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-109216

The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'profilebackground' parameter in all versions up to, and including, 5.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-110184

The Newsmatic theme for WordPress is vulnerable to blind SQL Injection via the 'slug' parameter in all versions up to, and including, 1.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-115821

The NewsmanApp plugin for WordPress (versions ≤ 3.7.29 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the 'billing_first_name' and 'billing_last_name' parameters. This flaw allows unauthenticated attackers to inject ...

CVE-2026-92086

The MW WP Form plugin for WordPress (versions up to and including 5.1.7 ) is vulnerable to Sensitive Information Exposure via the post_id parameter. This flaw allows unauthenticated attackers to extract personally identifiable information (PII)—such as names, email addresses, and free-text messag...

CVE-2026-115821 NewsmanApp <= 3.7.29 - Unauthenticated Stored Cross-Site Scripting via 'billing_first_name' and 'billing_last_name' Parameters

The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billingfirstname, billinglastname' parameter in all versions up to, and including, 3.7.29 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-110184 Newsmatic <= 1.5.0 - Unauthenticated SQL Injection via 'slug' Parameter

The Newsmatic theme for WordPress is vulnerable to blind SQL Injection via the 'slug' parameter in all versions up to, and including, 1.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...