CVE-2026-118205: wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets: The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to…

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.8.7 via the pageid parameter of the registeruser function. The vulnerability exists because the handler's post status...

cve-2022-1609-exploit

cve-2022-1609-exploit Exploit for CVE-2022-1609 WordPress Weblizar Backdoor...

CVE-2022-0236

CVE-2022-0236 The WP Import Export WordPress plugin is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpieprocessfiledownload found in the /includes/classes/class-wpie-general.php file. This made it possible for unauthenticated...

WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE; Exploitation Attempts Detected After Release

TL;DR: WordPress 7.1.4 was released on October 28, 2026. According to WordPress, it includes fixes for 22 security vulnerabilities. The most serious is an unauthenticated race condition in the Core update process that can lead to remote code execution. Threat actors are already actively attemptin...

CVE-2026-119325

Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the loadpopupcontent REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks...

WordPress Gravity Forms plugin <= 3.1.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin Gravity Forms versions = 3.1.1...

CVE-2026-119325 Bricks Theme Broken Access Control via load_popup_content

Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the loadpopupcontent REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks...

CVE-2026-119325 Bricks Theme Broken Access Control via load_popup_content

Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the loadpopupcontent REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks...

CVE-2026-119325

Bricks Theme version 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint. The flaw allows anonymous attackers to read draft and unpublished page content because the popupId parameter is processed without status or ca...

EUVD-2026-113376

Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the loadpopupcontent REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks...

[SECURITY] [DSA 6596-1] wordpress security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6596-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 29, 2026 https://www.debian.org/security/faq -...

WordPress Gravity Forms plugin <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Gravity Forms versions = 3.1.2...

WordPress Gravity Forms plugin <= 3.1.2 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Tin Pham TF1T, Hao Ngo, Trong Pham in WordPress Plugin Gravity Forms versions = 3.1.2...

Wordfence Bug Bounty Program Monthly Report – July 2026

In July 2026, the Wordfence Bug Bounty Program received 1077 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence Threat...

WordPress Food Store – Online Food Delivery & Pickup plugin <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by GivMeInJ in WordPress Plugin Food Store – Online Food Delivery & Pickup versions = 1.5.5...

WordPress AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini plugin <= 3.8.6 - Missing Authorization to Administrator Account Takeover vulnerability

Missing Authorization to Administrator Account Takeover vulnerability discovered by satoshigpt2021-sketch in WordPress Plugin AI Engine versions = 3.8.6...

WordPress Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin <= 1.55.0.2 - Unauthenticated Limited File Deletion vulnerability

Unauthenticated Limited File Deletion vulnerability discovered by Emiliano Versini in WordPress Plugin Forminator versions = 1.55.0.2...

WordPress Export and Import Users and Customers plugin <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Sebastian Albrecht mySebbe in WordPress Plugin Import Export WordPress Users versions = 2.7.5...

CVE-2025-6934

CVE-2025-6934 Auto Exploit ⚡ Overview CVE-2025-6934 is a proof-of-concept PoC exploit targeting WordPress Plugin: Opal Estate Pro ≤ 1.7.5. This exploit demonstrates unauthenticated administrator account creation. Disclaimer: This PoC is for educational purposes only. Do not use on systems without...

Mass-Scanner-CVE-2026-1405

⚡ Mass-Scanner-CVE-2026-1405 Clean WordPress Mass Scanner for CVE-2026-1405 🧠 Overview A clean and lightweight scanner built to check CVE-2026-1405 exposure across multiple WordPress targets. It focuses on: fast multi-target scanning clean terminal output simple result classification easy usage f...