CVE-2026-95530

The PixelYourSite – Your smart PIXEL (TAG) Manager WordPress plugin is vulnerable to a Subscriber Cross Site Scripting (XSS) flaw in versions

CVE-2026-95529

The Calculated Fields Form plugin for WordPress is vulnerable to an unauthenticated Cross Site Scripting (XSS) flaw in versions

CVE-2026-95528

The Core Web Vitals & PageSpeed Booster WordPress plugin, in versions

CVE-2026-95527

The Conekta Payment Gateway WordPress plugin, versions

CVE-2026-95525

The WP User Frontend plugin for WordPress, affecting versions

CVE-2026-95523

The WP User Frontend plugin for WordPress, versions

CVE-2026-95524

The WP User Frontend WordPress plugin, affecting versions

CVE-2026-95522

The Easy Digital Downloads WordPress plugin (versions

CVE-2026-95515

The Ninja Forms WordPress plugin, version 3.15.3 and below , is vulnerable to an unauthenticated Cross Site Scripting (XSS) . This vulnerability allows an attacker to execute malicious scripts in the context of the user's browser. No specific root cause, exploit links, or remediation steps are pr...

CVE-2026-95513

The Online Booking & Scheduling Calendar for WordPress by vcita plugin, affecting versions

CVE-2026-95514

The Netgsm WordPress plugin, affecting versions

CVE-2026-94684

This CVE ID is rejected and does not represent an active vulnerability entry.

CVE-2026-94680

The The Post Grid WordPress plugin, versions

CVE-2026-94682

The Podcast Importer SecondLine plugin for WordPress, in versions

CVE-2026-94679

The Fluent Support WordPress plugin, version 2.3.2 and below , is affected by a Broken Access Control vulnerability. This flaw allows for unauthorized actions within the subscriber context. No specific technical root cause, practical consequences, or remediation steps are provided in the availabl...

CVE-2026-94671

The The Post Grid WordPress plugin, version 7.9.5 and below , is affected by a Contributor Cross Site Scripting (XSS) vulnerability. While the specific root cause and affected functions are not detailed in the provided documents, the vulnerability allows for XSS execution within the context of a ...

CVE-2026-94500

The ElementsKit Elementor addons Lite WordPress plugin is vulnerable to a Contributor Cross Site Scripting (XSS) vulnerability in versions

CVE-2026-94498

The AppMySite WordPress plugin (versions

CVE-2026-94487

The PublishPress Capabilities WordPress plugin, in versions

CVE-2026-94461

The Ditty plugin for WordPress, affecting versions

CVE-2026-94457

The WordPress Captcha Code plugin (versions ≤ 3.32 ) is vulnerable to an unauthenticated bypass vulnerability. While the specific root cause and practical consequences are not detailed in the provided documents, the flaw allows for a bypass of security measures. No specific exploits, mitigation s...

CVE-2026-94391

The Ultimate FAQ WordPress plugin, version 2.4.14 and below , is vulnerable to a Contributor Cross-Site Scripting (XSS) flaw. The vulnerability allows for the execution of malicious scripts within the context of the application. While the CVSSv3.1 score is 6.5 (Medium) , the attack requires low p...

CVE-2026-94176

The Mang Board WP WordPress plugin versions

CVE-2026-94179

The Razorpay Payment Button WordPress plugin versions

CVE-2026-94174

The WordPress Email Log plugin in versions

CVE-2026-94168

The Premium Addons for Elementor WordPress plugin (versions

CVE-2026-94118

The Premium Blocks – Gutenberg Blocks for WordPress plugin affects versions

CVE-2026-94124

The WP EasyCart plugin for WordPress, versions

CVE-2026-94080

Versions of the MarketKing WordPress plugin up to and including 2.1.70 are susceptible to an unauthenticated broken access control vulnerability. The vulnerability allows an attacker to perform actions without proper authorization. No specific root cause, practical impact details, or remediation ...

CVE-2026-94079

The WP User Manager plugin for WordPress, affecting versions

CVE-2026-93773

The Mollie Forms WordPress plugin (versions

CVE-2026-93774

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in the WP Photo Album Plus WordPress plugin, affecting versions

CVE-2026-93772

The wpForo Forum plugin for WordPress, affecting versions

CVE-2026-93622

The WPS Limit Login WordPress plugin (versions

CVE-2026-93623

The AI Engine WordPress plugin versions

CVE-2026-93620

The PayPlus Payment Gateway WordPress plugin, in versions

CVE-2026-93618

The JetTricks plugin by Jetimpex Inc. (Crocoblock) is vulnerable to a Stored Cross-site Scripting (XSS) flaw due to improper neutralization of input during web page generation. This vulnerability affects versions from the initial release through 2.0.1 . Practical consequences include the ability ...

CVE-2026-93527

The Live Copy Paste for Elementor WordPress plugin, versions

CVE-2026-93529

The WSP MCP – AI Agents Connector plugin for WordPress versions ≤ 2.7.0 is affected by a Broken Access Control vulnerability. The vulnerability specifically affects contributors , which may allow for unauthorized actions or data modification due to improper permission enforcement. No specific roo...

CVE-2026-93526

The Event Tickets WordPress plugin (versions

CVE-2026-93513

The SiteSkite WordPress plugin, versions

CVE-2026-77420

The JLine Java library (versions 3.0.0 to 3.30.14 and 4.3.1) is vulnerable to a Denial of Service (DoS) attack due to improper escaping of the HISTORY_IGNORE configuration value. The DefaultHistory.matchPatterns method in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java conv...

CVE-2026-77422

The JLine Java library (versions 3.0.0 through 3.30.15 and 4.3.1 ) is vulnerable to a Denial of Service (DoS) condition in its built-in grep command. The root cause is that the component accepts user-controlled regular expressions and, unless in line-regexp mode, automatically adds a dot-star pre...

CVE-2026-75131

The NetworkManager-l2tp software (through version 1.52.4) contains a privilege escalation vulnerability. A local user with permissions to create VPN connections can execute arbitrary code as root by injecting pppd options via a crafted VPN username. By embedding a double-quote character or whites...

CVE-2026-96541

A denial-of-service flaw exists in gnome-remote-desktop where an unauthenticated remote attacker can exhaust global connection limits. This occurs because the software fails to enforce a pre-authentication handshake deadline , allowing an attacker to open RDP connections and retain connection-thr...

CVE-2026-96544

An integer overflow flaw exists in the GIMP PVR image loader within the pvr_decode_rect() function. When a user opens a crafted PVR image, the software performs unchecked multiplication of attacker-controlled dimensions, potentially leading to an undersized heap allocation and a subsequent out-of...

CVE-2026-71459

The Red Hat Ansible Automation Platform (automation-controller ) is vulnerable to a cross-tenant job event data exposure due to a missing RBAC check in the JobJobEventsChildrenSummary view. The underlying cause is that the view lacks a model/parent_model definition, causing ModelAccessPermission....

CVE-2026-71458

The Red Hat Ansible Automation Platform (versions 2.5 and 2.6) is vulnerable to a Named-URL 404 body oracle (CVE-2026-71458). The root cause is that URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC is applied. While a shim rewrites 403 responses to...

CVE-2026-77421

The JLine Java library, used for handling console input, is vulnerable to a Denial of Service (DoS) condition in its built-in nano editor 's regex search mode. Specifically, the doSearch(String text) function in builtins/src/main/java/org/jline/builtins/Nano.java passes user-controlled search ter...

CVE-2026-92730

LimeSurvey Community Edition 7.0.14 is vulnerable to a reflected cross-site scripting (XSS) flaw on the administrative survey-participant CSV import result page. The root cause is triggered via an invalid attribute column name . Exploitation details and specific remediation steps are not provided...