WordPress Greenshift – animation and page builder blocks plugin <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Greenshift versions = 13.2.1...

WordPress Media Library Assistant plugin <= 3.42 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin Media LIbrary Assistant versions = 3.42...

WordPress NEX-Forms – Ultimate Forms Plugin for WordPress plugin <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by nh4tvd in WordPress Plugin NEX-Forms versions = 9.3.2...

WordPress RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin <= 5.2.12 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by hamachijp in WordPress Plugin Feedzy versions = 5.2.12...

WordPress Extensions for Leaflet Map plugin <= 5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by zickzick2 in WordPress Plugin Extension for Leaflet Map versions = 5.4...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

PHP2shell — Exploitation for CVE-2026-109618 / CVE-2026-109619...

CVE-2026-78395

The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when processing its front-end link submission, allowing unauthenticated users to submit links to a library configured to require login by reusing a form token obtained from another libra...

CVE-2026-78396

The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose display template is used to render it, allowing unauthenticated users to disclose the telephone number, e-mail address and submitter name stored with links that the settings set...

CVE-2026-85007

The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset AJAX handler, allowing users with the Contributor role and above to read the site-wide player-preset configuration, and in versions before 2.1.1 to modify and delete it as well...

CVE-2026-86794

The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks when processing public event submissions, and does not escape several of the submitted values before outputting them in the administration dashboard and on the public calendar, allowing unauthenticated...

CVE-2026-89216

The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and extract data from the database...

CVE-2026-115302

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records, allowing unauthenticated attackers to delete arbitrary statistics entries...

CVE-2026-115301

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator to perform server-side template injection and execute...

CVE-2026-115245

The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a spoofable client-supplied content type, allowing unauthenticated attackers to upload arbitrary files, including PHP, which can lead to remote code execution...

CVE-2026-115299

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attacker to overwrite the site's outbound mail configuration, including the SMTP server, its credentials and the notification recipient, by tricking a logged-in...

CVE-2026-115259

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.6.0 does not have proper authorization checks when updating post data through one of its REST API routes in all versions up to, and including, 6.5.8. This makes it possible for authenticated attackers, with Author-level access...

CVE-2026-115282

The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering posts through its recipe print feature, allowing unauthenticated users to disclose the title, ID and recipe content of unpublished posts, including drafts, pending, private and...

CVE-2026-111739

The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security AIOS WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker who knows a victim's password and holds their own...

CVE-2026-113617

The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to read arbitrary files including ones containing the database credentials and...

CVE-2026-114270

The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password...