323257 matches found
CVE-2026-107627
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-110707
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:group/media:description XML element in the imported feed' parameter in all versions up to, and including, 5.2.12 due to...
CVE-2026-103875
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search-string' parameter in all versions up to, and including, 3.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
CVE-2026-103485
The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feature.properties' parameter in all versions up to, and including, 5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
WordPress Community Events plugin < 1.6.0 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Community Events versions 1.6.0...
WordPress Chat AI with Dispatcher plugin < 2.4 - Unauthenticated Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Chat AI with Dispatcher versions 2.4...
WordPress LogixFast Auth plugin < 1.0.4 - Unauthenticated Account Takeover vulnerability
Unauthenticated Account Takeover vulnerability discovered by Naoki Kawahigashi in WordPress Plugin LogixFast Auth versions 1.0.4...
WordPress ProfileGrid plugin < 6.0.0.5 - Unauthenticated PHP Object Injection vulnerability
Unauthenticated PHP Object Injection vulnerability discovered by sungbyeongchan in WordPress Plugin ProfileGrid versions 6.0.0.5...
WordPress Frontend Dashboard plugin < 3.0.5 - Unauthenticated PHP Object Injection vulnerability
Unauthenticated PHP Object Injection vulnerability discovered by sungbyeongchan in WordPress Plugin Frontend Dashboard versions 3.0.5...
WordPress Two Factor Authentication plugin < 1.17.0 - Subscriber+ 2FA Bypass vulnerability
Subscriber+ 2FA Bypass vulnerability discovered by Karol Czubernat in WordPress Plugin Two Factor Authentication versions 1.17.0...
WordPress Hide Price Until Login plugin < 1.1.2 - Unauthenticated Account Creation vulnerability
Unauthenticated Account Creation vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Hide Price Until Login versions 1.1.2...
EUVD-2026-112693
The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href attribute of inside .htmega-tab-nav' parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and...
CVE-2026-111318
The HT Mega Addons for Elementor WordPress plugin (versions <= 3.2.7 ) is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping in the href attribute of tags within the .htmega-tab-nav parameter of the Tabs widget . U...
CVE-2026-91153
The Everest Forms WordPress plugin (versions up to and including 3.6.2 ) is vulnerable to Sensitive Information Exposure due to a Smart-Tag Injection flaw. Unauthenticated attackers can extract arbitrary WordPress post meta values , such as license keys, API tokens, SMTP credentials, and Stripe o...
CVE-2026-91153 Everest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the process. This makes it possible for unauthenticated attackers to extract arbitrary...
EUVD-2026-112691
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the process. This makes it possible for unauthenticated attackers to extract arbitrary...
CVE-2026-91153 Everest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the process. This makes it possible for unauthenticated attackers to extract arbitrary...
CVE-2026-116763 LiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace)
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2026-107743
The Mapster WP Maps plugin for WordPress (versions
CVE-2026-116763
The LiteSpeed Cache plugin for WordPress (versions up to and including 7.9.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'comment' parameter . The root cause is insufficient input sanitization and output escaping. This vulnerability is specifically exploitable when the HTML Minif...