EUVD-2026-55803

Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying directory traversal sequences in the sucuriscanintegrity...

CVE-2026-73033 Sucuri WordPress Plugin 2.7.3 Path Traversal via integrity.lib.php

Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying directory traversal sequences in the sucuriscanintegrity...

Imperva Customers Protected Against XSS2Shell (CVE-2026-64638) in WordPress Core

TL;DR: CVE-2026-64638, dubbed XSS2Shell, is a high-severity WordPress Core vulnerability that begins as a pre-authentication reflected XSS on the login screen and can be chained to PHP code execution when a logged-in administrator is successfully targeted. WordPress fixed the issue in 7.0.3 and...

[SECURITY] [DSA 6427-1] wordpress security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6427-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 10, 2026 https://www.debian.org/security/faq -...

WordPress Kirki – Freeform Page Builder, Website Builder & Customizer plugin <= 6.2.0 - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Freeform Page Builder, Website Builder & Customizer plugin = 6.2.0 - Freeform Page Builder, Website Builder & Customizer = 6.2.0 - Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Navapon Premkasem 71C4 71C4 in WordPress Plugin Kirki versions = 6.2.0...

WordPress Directories Pro plugin <= 2.0.5 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin Directories Pro versions = 2.0.5...

WordPress WpBookingly plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin WpBookingly versions = 1.3.2...

WordPress Anti Spam and list cleaner – AcyChecker plugin <= 2.0.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by vnth4nhnt in WordPress Plugin Anti Spam and list cleaner AcyChecker versions = 2.0.0...

WordPress Nokri theme <= 1.6.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by VanTastic in WordPress Theme Nokri versions = 1.6.6...

WordPress Motors plugin <= 1.4.113 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mohamed Bassia in WordPress Plugin Motors versions = 1.4.113...

WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Asim Alshaya in WordPress Plugin Colissimo Officiel : Méthodes de livraison pour WooCommerce versions = 2.10.0...

WordPress SureDash plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Asim Alshaya in WordPress Plugin SureDash versions = 1.10.1...

WordPress Smart Online Order for Clover plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Asim Alshaya in WordPress Plugin Smart Online Order for Clover versions = 1.6.1...

WordPress Gutenverse Companion plugin <= 2.5.1 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Gutenverse Companion versions = 2.5.1...

WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Arif Shaikh in WordPress Plugin Taxi Booking Manager for WooCommerce versions = 2.0.3...

WordPress WPJAM Basic plugin <= 7.0.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dutafi in WordPress Plugin WPJAM Basic versions = 7.0.1...

WordPress Church Admin plugin <= 5.1.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Zainul Anwar Adi Putra in WordPress Plugin Church Admin versions = 5.1.1...

WordPress Payment Forms for Paystack plugin <= 4.0.5 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Muhan Luo in WordPress Plugin Payment Forms for Paystack versions = 4.0.5...

CVE-2026-66642

WP Umbrella WordPress plugin versions up to 2.26.2 are affected by a Cross-Site Request Forgery (CSRF) vulnerability. Affected: WP Umbrella from n/a through 2.26.2. CVSSv3.1: base score 5.4 (Medium); Vector: Network; Attack complexity: Low; Privileges required: None; User interaction required; Im...

CVE-2026-66642 WordPress WP Umbrella plugin 2.24.2-2.26.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in WP Umbrella allows Cross Site Request Forgery. This issue affects WP Umbrella: from 2.24.2 through 2.26.2...