EUVD-2026-83507

The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that executes in the session of any administrator...

CVE-2026-76554 WP Import Export Lite < 3.9.35 - Authenticated Privilege Escalation via User Import

The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage...

EUVD-2026-83500

The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage...

CVE-2026-76554 WP Import Export Lite < 3.9.35 - Authenticated Privilege Escalation via User Import

The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage...

CVE-2026-76554

The WP Import Export Lite WordPress plugin (versions before 3.9.35 ) is vulnerable to an authenticated privilege escalation due to improper privilege management. The plugin fails to verify if a user running an import is authorized to create or modify user accounts and assign roles. This allows us...

CVE-2026-89274

The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. The vulnerability exists because WPRMMetadata::sanitizemetadata recursively calls doshortcode on every scalar field of the recipe's structured metadata array —...

CVE-2026-87909

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppaimagemagick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec, with only...

CVE-2026-89274 WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content

The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. The vulnerability exists because WPRMMetadata::sanitizemetadata recursively calls doshortcode on every scalar field of the recipe's structured metadata array —...

CVE-2026-89274 WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content

The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. The vulnerability exists because WPRMMetadata::sanitizemetadata recursively calls doshortcode on every scalar field of the recipe's structured metadata array —...

EUVD-2026-83476

The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. The vulnerability exists because WPRMMetadata::sanitizemetadata recursively calls doshortcode on every scalar field of the recipe's structured metadata array —...

CVE-2026-89274

WP Recipe Maker for WordPress (all versions ≤ 10.8.1) is vulnerable to unauthenticated arbitrary shortcode execution via recipe comment content. The root cause lies in WPRM_Metadata::sanitize_metadata(), which recursively calls do_shortcode() on every scalar metadata field — including reviewBody,...

EUVD-2026-83471

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppaimagemagick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec, with only...

CVE-2026-87909

The WP Photo Album Plus WordPress plugin (versions ≤ 9.2.09.002 ) is vulnerable to authenticated remote code execution (CVSS 7.5 HIGH) via the wppa_image_magick function. The root cause is insufficient sanitization of a multipart upload filename before it is concatenated into an ImageMagick comma...

CVE-2026-87909 WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppaimagemagick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec, with only...

CVE-2026-87909 WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppaimagemagick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec, with only...

PT-2026-95748

Name of the Vulnerable Software and Affected Versions Pochipp versions prior to 1.20.3 Description The plugin is subject to Reflected Cross-Site Scripting, a flaw where an application includes untrusted data in a web page without proper validation or escaping. This occurs because the application...

CVE-2026-11608: Improper Neutralization of Input During Web Page Generation

The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3fname' parameter in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2026-95783

Name of the Vulnerable Software and Affected Versions Wow Elements Addons for Elementor versions prior to 1.11.3 Description This issue is a Server-Side Request Forgery, a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. Authenticated...

PT-2026-95771

Name of the Vulnerable Software and Affected Versions WP Customer Reviews versions prior to 3.7.9 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs via the wpcr3 fname parameter, enabling the...

CVE-2026-76554: Improper Privilege Management

The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage...