EUVD-2026-63343

Unauthenticated Cross Site Scripting XSS in GeoDirectory = 2.8.173 versions...

CVE-2026-66604

An unauthenticated reflected/stored XSS vulnerability exists in the GeoDirectory WordPress plugin (versions ≤ 2.8.173), allowing an attacker to inject malicious scripts into pages viewed by other users without authentication, enabling session hijacking or credential theft. No in-the-wild exploita...

EUVD-2026-63342

Subscriber Cross Site Scripting XSS in Media LIbrary Assistant = 3.39 versions...

EUVD-2026-63341

Author Arbitrary File Upload in Media LIbrary Assistant = 3.39 versions...

CVE-2026-66600 WordPress Media LIbrary Assistant plugin <= 3.39 - Arbitrary File Upload vulnerability

Author Arbitrary File Upload in Media LIbrary Assistant = 3.39 versions...

CVE-2026-66600

Media Library Assistant WordPress plugin (versions ≤ 3.39) allows users with the Author role to upload arbitrary files, potentially enabling remote code execution. CVSS 9.1 (Critical) reflects network-exploitable, low-complexity attack with full confidentiality, integrity, and availability impact...

CVE-2026-66601 WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Media LIbrary Assistant = 3.39 versions...

CVE-2026-66601

Subscriber-level authenticated users can inject arbitrary JavaScript into the Media Library Assistant plugin (≤3.39) admin interface, enabling session hijacking or data theft. CVSS 6.5 (MEDIUM). Update to version 3.40 or later; no in-the-wild exploitation reported. See: https://patchstack.com/dat...

EUVD-2026-63340

Unauthenticated Cross Site Scripting XSS in B2BKing Premium = 5.6.07 versions...

CVE-2026-66598 WordPress B2BKing Premium plugin <= 5.6.07 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in B2BKing Premium = 5.6.07 versions...

CVE-2026-66598

CVE-2026-66598 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin B2BKing Premium , affecting versions 5.6.07 and earlier . The vulnerability was discovered by dutafi and is rated CVSS 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating ...

EUVD-2026-63339

Unauthenticated Cross Site Scripting XSS in wpDataTables = 6.5.1.4 versions...

CVE-2026-66597 WordPress wpDataTables plugin <= 6.5.1.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in wpDataTables = 6.5.1.4 versions...

CVE-2026-66597

An unauthenticated Cross-Site Scripting (XSS) vulnerability affects the wpDataTables WordPress plugin in versions 6.5.1.4 and earlier . The flaw allows an attacker to inject malicious scripts that execute in the context of a victim's browser, requiring user interaction. The CVSS 3.1 base score is...

CVE-2026-66595 WordPress WP Data Access plugin <= 5.5.80 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Data Access = 5.5.80 versions...

EUVD-2026-63337

Subscriber SQL Injection in WordPress Persistent Login = 3.1.0 versions...

EUVD-2026-63338

Unauthenticated Broken Access Control in WP Data Access = 5.5.80 versions...

CVE-2026-66594 WordPress WordPress Persistent Login plugin <= 3.1.0 - SQL Injection vulnerability

Subscriber SQL Injection in WordPress Persistent Login = 3.1.0 versions...

CVE-2026-66595

The WordPress WP Data Access plugin (versions ≤ 5.5.80) has an unauthenticated broken access control flaw allowing remote, no-auth access to restricted functionality with HIGH confidentiality impact (CVSS 5.9). No patch version or exploitation details are provided; monitor Patchstack's advisory f...

CVE-2026-66594

The WordPress Persistent Login plugin (versions ≤ 3.1.0) has a subscriber-level SQL injection vulnerability exploitable over the network with low privileges. CVSS 8.5 (HIGH) reflects high confidentiality impact and low availability impact. No in-the-wild exploitation is reported. Upgrade to a ver...