CVE-2026-66638

Contributor Cross Site Scripting XSS in Frontend Admin by DynamiApps = 3.29.10 versions...

CVE-2026-66640

Contributor Cross Site Scripting XSS in Login With Ajax = 4.5.1 versions...

CVE-2026-66621

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MapSteps UG Ultimate Dashboard Pro allows DOM-Based XSS. This issue affects Ultimate Dashboard Pro: from n/a through 3.11.2...

CVE-2026-66620

Editor PHP Object Injection in OptionTree = 2.7.3 versions...

CVE-2026-66629

Unauthenticated Cross Site Scripting XSS in Kirki = 6.2.3 versions...

CVE-2026-32547

Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.22 versions...

CVE-2026-32553

Unauthenticated Server Side Request Forgery SSRF in OttoKit = 1.1.35 versions...

CVE-2026-32474

Contributor Arbitrary File Upload in Templatiq = 0.2.5 versions...

CVE-2026-32549

Unauthenticated Broken Access Control in ThumbPress 6.5 versions...

CVE-2026-32481

Unauthenticated Broken Authentication in Ezoic = 2.22.11 versions...

CVE-2026-32473

Unauthenticated Server Side Request Forgery SSRF in PDF Smart Viewer for Elementor = 1.0.4 versions...

CVE-2026-32472

Unauthenticated Broken Access Control in Online Contact Widget = 1.3.0 versions...

CVE-2026-32468

Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway = 2.11.14 versions...

CVE-2026-32467

Subscriber Server Side Request Forgery SSRF in Aotuman Grab WeChat Articles = 2.0.1 versions...

CVE-2026-32444

Contributor Remote Code Execution RCE in Cwicly = 1.4.4 versions...

CVE-2026-32464

Unauthenticated Local File Inclusion in Theme Test Drive = 2.9.1 versions...

CVE-2026-28567

Unauthenticated Broken Access Control in WP Sort Order = 1.3.5 versions...

CVE-2026-28191

Subscriber Privilege Escalation in The Grid = 2.7.9.1 versions...

CVE-2026-28569

Unauthenticated Cross Site Scripting XSS in SSL Zen = 4.7.43 versions...

EUVD-2026-60820

HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the firstname field of t...