CVE-2026-114193 WordPress GEO my WordPress plugin <= 4.5.5.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GEO my WordPress: from n/a through 4.5.5.5...

CVE-2026-114193

The GEO my WordPress (geo-my-wp) plugin, developed by Eyal Fitoussi, is vulnerable to a Missing Authorization flaw (CWE-862) in versions up to 4.5.5.5 . This vulnerability allows for the exploitation of incorrectly configured access control security levels . According to the provided metrics, the...

CVE-2026-114193 WordPress GEO my WordPress plugin <= 4.5.5.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GEO my WordPress: from n/a through 4.5.5.5...

EUVD-2026-112732

Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GEO my WordPress: from n/a through 4.5.5.5...

CVE-2026-115963 WordPress Broadcast Live Video plugin <= 7.3.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.9...

CVE-2026-115963 WordPress Broadcast Live Video plugin <= 7.3.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.9...

CVE-2026-115963

The VideoWhisper.com Broadcast Live Video (videowhisper-live-streaming-integration) WordPress plugin is affected by a Missing Authorization vulnerability (CWE-862). This flaw allows for Exploiting Incorrectly Configured Access Control Security Levels in versions from n/a through 7.3.9 . The vulne...

WordPress All-In-One Security (AIOS) plugin < 5.5.0 - Subscriber+ 2FA Bypass vulnerability

Subscriber+ 2FA Bypass vulnerability discovered by Karol Czubernat in WordPress Plugin All In One WP Security & Firewall versions 5.5.0...

CVE-2026-91152

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'evftoasttype' parameter in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping...

CVE-2026-91153

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the process. This makes it possible for unauthenticated attackers to extract arbitrary...

CVE-2026-116763

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-118192

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'teamid' parameter in all versions up to, and including, 5.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2026-107627

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-107743

The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.5. This is due to the /wp-json/mapster-wp-maps/save-mapmaker REST route being registered with a permissioncallback that unconditionally returns true no capability check, no...

CVE-2026-104727

The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'condition' Post Meta Array Keys in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-107629

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-109215

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bbpreplycontent' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-lev...

CVE-2026-110707

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:group/media:description XML element in the imported feed' parameter in all versions up to, and including, 5.2.12 due to...

CVE-2026-103875

The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search-string' parameter in all versions up to, and including, 3.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-103485

The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feature.properties' parameter in all versions up to, and including, 5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...