CVE-2026-105064

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin is vulnerable to Parameter Injection due to a Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability (CWE-470). This flaw impacts versions up to and including 2.0.22 ....

CVE-2026-103351

The Taxi Booking Manager for WooCommerce plugin by Magepeople inc. (versions up to and including 2.1.1 ) is susceptible to an Improper Validation of Specified Quantity in Input vulnerability (CWE-1284). This flaw allows for Input Data Manipulation , potentially impacting the integrity of data pro...

CVE-2026-104389

The Sirv WordPress plugin versions up to and including 8.2.5 are vulnerable to a Blind SQL Injection flaw. This vulnerability is caused by the improper neutralization of special elements used in an SQL command. Exploitation allows an attacker to execute arbitrary SQL commands. No specific exploit...

CVE-2026-104388

The PowerPress Podcasting plugin for WordPress (versions

CVE-2026-102393

The Brainstorm Force Starter Templates (astra-sites) WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This issue affects versions from n/a through 4.7.7 . The documents do not provide specific details regarding...

CVE-2026-103079

The Ahmad JS Help Desk (js-support-ticket) plugin for WordPress, versions n/a through 4.0.0 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The root cause is an Authorization Bypass Through User-Controlled Key , where incorrectly configured access control security levels allow una...

CVE-2026-104396

The Jeroen Peters Name Directory WordPress plugin (versions

CVE-2026-102914

The Presto Player WordPress plugin (versions 4.5.2 and below ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw due to the Improper Neutralization of Input During Web Page Generation (CWE-79). This vulnerability allows an attacker to inject malicious scripts that are stored on the server...

CVE-2026-104675

The Liquid Web / StellarWP Event Tickets plugin (versions up to and including 5.30.0 ) is susceptible to a Missing Authorization vulnerability (CWE-862). This flaw allows for Exploiting Incorrectly Configured Access Control Security Levels . The impact of this vulnerability is characterized by a ...

CVE-2026-103084

The LeapWorx Premium Addons for Elementor WordPress plugin (versions up to and including 4.11.109 ) is vulnerable to Stored Cross-Site Scripting (XSS) . This issue stems from the improper neutralization of input during web page generation . Exploitation of this vulnerability could lead to the exe...

CVE-2026-104397

The Jeroen Peters Name Directory WordPress plugin (versions up to and including 1.34.2 ) is vulnerable to a Missing Authorization vulnerability. This flaw allows for the exploitation of incorrectly configured access control security levels , potentially leading to Arbitrary Shortcode Execution . ...

CVE-2026-105060

The WordPress Logo Showcase plugin (by Themepoints) is vulnerable to a Stored Cross-site Scripting (XSS) flaw in versions 4.0.4 and earlier . The root cause is the improper neutralization of input during web page generation. This vulnerability allows an attacker to inject and execute malicious sc...

CVE-2026-104673

The Sonaar MP3 Audio Player for Music, Radio & Podcast WordPress plugin (versions n/a through 5.14.2 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the improper neutralization of input during web page generation. This vulnerability could allow an attacker to execut...

CVE-2026-105056

The impleCode eCommerce Product Catalog plugin for WordPress versions up to and including 3.6.2 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. This vulnerability stems from the improper neutralization of input during web page generation . An attacker could potentially execute maliciou...

CVE-2026-105263

Shaarli versions up to 0.16.3 are vulnerable to a server-side request forgery (SSRF) flaw in the Admin Metadata Endpoint . The root cause is located in the MetadataController function within the file application/front/controller/admin/MetadataController.php, where a manipulation of the url argume...

CVE-2026-103510

P4 Search versions prior to 2026.4.2 are vulnerable to an authentication bypass because the service does not fail securely when presented with a blank authentication token . An unauthenticated attacker with network access can exploit this flaw to obtain highest application privileges , potentiall...

CVE-2026-104408

The Groundhogg WordPress plugin, affecting versions up to and including 4.8.3 , is susceptible to a Blind SQL Injection vulnerability. The root cause is the Improper Neutralization of Special Elements used in an SQL command. This flaw allows an attacker with high privileges to perform SQL injecti...

CVE-2026-103335

The Video Conferencing with Zoom plugin for WordPress (by Deepen Bajracharya) is vulnerable to a Sensitive Data Exposure issue in versions up to and including 4.6.10 . The vulnerability, classified as CWE-201 , allows for the retrieval of embedded sensitive data from the video-conferencing-with-z...

CVE-2026-105055

The WP Mailster plugin for WordPress, versions up to 1.9.0.0 , is vulnerable to a Broken Access Control issue. This vulnerability stems from missing authorization within the wp-mailster component, which allows for the exploitation of incorrectly configured access control security levels. The vuln...

CVE-2026-103511

Prior to version 2026.4.2 , Perforce P4 Search is vulnerable to an arbitrary file-write flaw. The software fails to validate file names provided to its extension installation feature . An attacker possessing super-user or service-token privileges can exploit this to write files containing arbitra...