CVE-2026-66646 WordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in WP Tab Widget = 1.2.11 versions...

EUVD-2026-60892

Unauthenticated Broken Access Control in WP Sort Order = 1.3.5 versions...

CVE-2026-28567

Unauthenticated Broken Access Control in WP Sort Order = 1.3.5 versions...

CVE-2026-28567 WordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Sort Order = 1.3.5 versions...

CVE-2026-28567 WordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Sort Order = 1.3.5 versions...

CVE-2026-28567

The WordPress WP Sort Order plugin (versions ≤ 1.3.5) has an unauthenticated broken access control flaw, exploitable over the network with no credentials, exposing sensitive data (CVSS 7.5 HIGH). CISA confirms no active exploitation; upgrade to a patched version. Details at patchstack.com/databas...

WordPress Eventin plugin < 4.1.20 - Editor+ Local File Inclusion via speaker_template Setting vulnerability

Editor+ Local File Inclusion via speakertemplate Setting vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WP Event SOlution versions 4.1.20...

WordPress WP Compress plugin <= 7.10.09 - Cross-Site Request Forgery to Arbitrary Options Deletion vulnerability

Cross-Site Request Forgery to Arbitrary Options Deletion vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WP Compress versions = 7.10.09...

WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.3.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions = 4.3.9...

WordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by Charles Vosburgh in WordPress Plugin WP Compress versions 7.20.01...

WordPress WP Multilang plugin <= 2.4.31 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin WP Multilang versions = 2.4.31...

WordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Tab Widget versions = 1.2.11...

PT-2026-77088

Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...

PT-2026-77082

Subscriber Insecure Direct Object References IDOR in WP Crowdfunding 2.2.1 versions...

PT-2026-77128

Contributor Broken Access Control in WP Table Builder = 2.2.0 versions...

PT-2026-77034

Unauthenticated Broken Access Control in WP Sort Order = 1.3.5 versions...

PT-2026-77087

Unauthenticated Cross Site Scripting XSS in WP Multilang = 2.4.31 versions...

PT-2026-77097

Subscriber Cross Site Scripting XSS in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent = 4.3.9 versions...

CVE-2026-66646: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in WP Tab Widget = 1.2.11 versions...

PT-2026-77125

Name of the Vulnerable Software and Affected Versions Starter Templates by Kadence WP versions prior to 2.3.4 Description An unauthenticated Denial of Service DoS issue exists, allowing a remote attacker to cause the application to become unavailable without requiring authentication...