CVE-2026-19794: Improper Neutralization of Input During Web Page Generation

The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...

PT-2026-71971

The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...

wp-forge

wp-forge wp-forge scans WordPress.org plugins for serious PHP...

CVE-2026-73344

Author Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...

CVE-2026-66454

Unauthenticated Broken Access Control in WP Social Avatar = 1.5 versions...

CVE-2026-66426

Unauthenticated Cross Site Scripting XSS in WP-Stats = 2.56 versions...

CVE-2026-61974

Unauthenticated Cross Site Scripting XSS in Mang Board WP = 2.3.4 versions...

CVE-2026-61960

Unauthenticated Cross Site Scripting XSS in WP Full Stripe Free = 8.5.0 versions...

CVE-2026-61962

Unauthenticated Arbitrary Code Execution in WP BASE Booking = 6.3.0 versions...

CVE-2026-28174

Customer Sensitive Data Exposure in WP Event SOlution = 4.1.18 versions...

CVE-2026-28173

Customer Arbitrary Content Deletion in WP Event SOlution = 4.1.19 versions...

CVE-2026-28001

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

CVE-2026-27538

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

CVE-2026-73344

The CVE-2026-73344 entry concerns the WordPress WP Data Access plugin, affected versions

EUVD-2026-57910

Author Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...

CVE-2026-73344 WordPress WP Data Access plugin <= 5.5.79 - Cross Site Scripting (XSS) vulnerability

Author Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...

CVE-2026-66454 WordPress WP Social Avatar plugin <= 1.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Social Avatar = 1.5 versions...

EUVD-2026-57874

Unauthenticated Broken Access Control in WP Social Avatar = 1.5 versions...

CVE-2026-66454

CVE-2026-66454 affects the WordPress WP Social Avatar plugin (versions

CVE-2026-66454 WordPress WP Social Avatar plugin <= 1.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Social Avatar = 1.5 versions...