CVE-2026-28146

CVE-2026-28146 is about an Arbitrary File Download vulnerability in the WordPress plugin Unlimited Elements For Elementor (Free Widgets, Addons, Templates) , affecting versions up to and including 2.0.14. The connected reports identify the affected product and vulnerability type but do not provid...

CVE-2026-28146 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.14 - Arbitrary File Download vulnerability

Contributor Arbitrary File Download in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.14 versions...

CVE-2026-28143

Forminator plugin for WordPress is affected by CVE-2026-28143: unauthenticated XSS in versions up to and including 1.56.0. The vulnerability arises in the plugin code path handling input that can be crafted by an attacker without authentication. Impact, as described in the sources, is Cross Site ...

CVE-2026-28143 WordPress Forminator plugin <= 1.56.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Forminator = 1.56.0 versions...

CVE-2026-28141 WordPress NextGEN Gallery plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in NextGEN Gallery = 4.2.3 versions...

CVE-2026-28140

CVE-2026-28140 affects the WordPress JetFormBuilder plugin (versions ≤ 3.6.4.1). The vulnerability is an unauthenticated Broken Access Control, with an impact stated as high in the CVSS metrics (I=HIGH, C=NONE, A=NONE) while no confidentiality impact and no availability impact. The available docu...

CVE-2026-28140 WordPress JetFormBuilder plugin <= 3.6.4.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in JetFormBuilder = 3.6.4.1 versions...

CVE-2026-28139

CVE-2026-28139 concerns the WordPress plugin Ajax Search Lite (vulnerable: ≤ 4.14.4). The issue is an unauthenticated PHP Object Injection in the plugin’s handling of objects, as described in CVE details and corroborated by multiple feeds. Affected component: the Ajax Search Lite plugin; root cau...

CVE-2026-28111

CVE-2026-28111 affects the WordPress Forminator plugin up to version 1.56.0. The vulnerability is a contributor privilege escalation, with CVSSv3.1 metrics indicating high impact (C/H, I/H, A/H) and network attack vector with low complexity and low privileges required. Connected sources confirm t...

CVE-2026-28111 WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability

Contributor Privilege Escalation in Forminator = 1.56.0 versions...

CVE-2026-28082

CVE-2026-28082 affects the WordPress JetEngine plugin up to version 3.8.13.1, describing an unauthenticated Cross Site Scripting (XSS) vulnerability. The connected sources confirm the vulnerability existence and affected product/version but do not provide concrete technical details such as the ex...

CVE-2026-28082 WordPress JetEngine plugin <= 3.8.13.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.13.1 versions...

CVE-2026-28005 WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer = 1.5.19 versions...

CVE-2026-25403

Affected software: WordPress plugin “Ultimate Store Kit Elementor Addons”

CVE-2026-28005

CVE-2026-28005 is an unauthenticated privilege-escalation vulnerability affecting the WordPress plugin Kadence WooCommerce Email Designer (

CVE-2026-25403 WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

CVE-2026-66712 WordPress Simple Membership plugin <= 4.7.8 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Simple Membership = 4.7.8 versions...

CVE-2026-66712

CVE-2026-66712 affects the WordPress plugin Simple Membership versions

CVE-2026-15246 RealHomes Memberships < 3.1.0 - Subscriber+ Membership Payment Bypass

The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber to obtain paid membership packages...

CVE-2026-15246

Vulnerability summary (CVE-2026-15246). The RealHomes Memberships WordPress plugin prior to version 3.1.0 fails to verify that a membership payment completed, and does not check a nonce or user capability before granting a paid membership package. This allows any authenticated user (e.g., a Subsc...