CVE-2026-93654

The Premium Packages – Sell Digital Products Securely plugin for WordPress (versions up to and including 7.2.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the 'cart_items[][product_name]' parameter. Because the ch...

CVE-2026-17577

The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in versions up to and including 4.7.42 . The flaw exists in the ssl_zen_messages::getMessages() function, which processes the uri and host parameters. Because the application uses base64_decode() on the output ...

CVE-2026-92713

The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to and including 3.0.2 . The root cause is insufficient file path validation within the upload_image function, specifically failing to adequately restrict access via the file parameter. An au...

CVE-2026-93747

The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.1.6 . The flaw exists in the profile_update action where the raw $_POST['data'] array is copied into a $custom_fields variable; subsequent validation and sanitization functio...

CVE-2026-88996

The WPForms – AI Form Builder for WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 2.0.2 . The root cause is insufficient input sanitization and output escaping of the page_title POST parameter when processed via the {page_title} Smart Tag...

CVE-2026-96752

The Zero Spam for WordPress plugin for WordPress (versions up to and including 5.7.10 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the Contact Form 7 integration . An unauthenticated attacker can submit a Conta...

CVE-2026-96448

A flaw in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak allows for privilege escalation . The vulnerability exists because the system fails to inspect the contents of composite roles when verifying if a delegated administrator has permission to assign a specific role. Consequen...

CVE-2026-93477

The ash-project ash framework is vulnerable to an Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability. In versions 2.17.15 before 3.33.11 , the Ash.Actions.Destroy.Bulk.base_changeset/5 and Ash.Actions.Update.Bulk.base_changeset/5 functions fail to verify ...

CVE-2026-14281

The Automation Web Platform (WAWP) plugin for WordPress is vulnerable to unauthenticated privilege escalation in versions up to and including 4.8.6 . The root cause is a lack of permission enforcement on the POST /wp-json/wawp/v1/signup/ REST route and the absence of a key allowlist in the finish...

CVE-2026-92746

The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 4.0.8 . The root cause is insufficient input sanitization and output escaping within the Post Comment Block 'suffixMain' Attrib...

CVE-2026-94376

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 3.0.4 . The root cause is insufficient input sanitization and output escaping in the User Display Nam...

CVE-2026-93303

The HT Contact Form – Drag & Drop Form Builder for WordPress plugin is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) in versions up to and including 2.10.1 . The root cause is insufficient input sanitization and output escaping within the 'form_data' Rich Text Field during the Draft S...

CVE-2026-96039

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.8.27 . The root cause is insufficient input sanitization and output escaping of the first_name parameter. This allows unauthenticated attackers to inject arbitrary ...

CVE-2026-93399

The Bookly plugin for WordPress (versions up to and including 28.2 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The bookly_get_form_id handler blindly stores an attacker-controlled order_id into a booking session. The bookly_render_complete handler then trusts this session ...

CVE-2026-92799

The Bookly plugin for WordPress is vulnerable to an Authorization Bypass in all versions up to and including 28.2 . The root cause is PHP Type Juggling within the postValidateCustomer() function, which uses a loose inequality operator (!=) to compare a session-stored one-time verification code ag...

CVE-2026-92829

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 9.1.0 . The root cause is the plugin's failure to properly verify user authorization for specific actions, compounded by the fact that the b2s_secu...

CVE-2026-19775

The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to an authorization bypass in versions up to and including 1.1.7 . The root cause is the plugin's failure to properly verify user authorization before performing certain actions. This flaw a...

CVE-2026-96766

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress are vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.8.183 . The root cause is insufficient input sanitization and output escaping within the business_hours ...

CVE-2026-89055

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 5.120.0 . The root cause is the plugin's failure to properly verify user authorization when performing specific actions. This flaw allows unauthenticated attacker...

CVE-2026-93899

The Better Messages plugin for WordPress (all versions up to and including 3.0.4 ) is vulnerable to a generic SQL Injection via the 'group_id' Message Meta Parameter. The root cause is insufficient escaping of the user-supplied parameter and a lack of sufficient preparation on the existing SQL qu...