CVE-2026-77183

The FooSales – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to and including 1.43.0 . The root cause is a failure to properly validate a user's identity before updating details, such as email addresses, through ...

CVE-2026-91862

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.0.1 . The root cause is insufficient input sanitization and output escaping associated with the 'data-image-points' parameter. This flaw allows authenticated...

CVE-2026-94375

The Order Export & Order Import for WooCommerce plugin for WordPress (versions

CVE-2026-96667

The Real Estate Manager WordPress plugin (versions up to and including 7.3 ) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) . The flaw originates from insufficient input sanitization and output escaping of the 'first_name' parameter. This allows unauthenticated attackers to in...

CVE-2026-104763

The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 1.17.1 . An authenticated attacker with administrator-level access can perform an arbitrary file read by exploiting the file_path parameter within a media_metadata.json ...

CVE-2026-103520

The HivePress – Business Directory, Listings & Classified Ads Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.7.31 . The root cause is insufficient input sanitization and output escaping of the 'custom text attribute (user-defined field na...

CVE-2026-104725

The Groundhogg WordPress plugin (versions up to and including 4.9 ) is vulnerable to Privilege Escalation due to a missing ownership and capability check on the user parameter within the process_edit() function. This flaw allows authenticated users with the edit_contacts capability to reassign a ...

CVE-2026-14379

The GamiPress – Gamification plugin for WordPress (versions up to and including 7.9.4 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping associated with the 'video_id' parameter . This flaw allows authenticated attackers wi...

CVE-2026-16776

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 5.14.2 . The flaw stems from insufficient input sanitization and output escaping specifically within shortcode attribut...

CVE-2026-83526

The FV Player 8 plugin for WordPress (versions

CVE-2026-104742

The AI Puffer (formerly AI Power) plugin for WordPress is vulnerable to an authorization bypass in versions up to and including 2.4.89 . The root cause is the plugin's failure to properly verify user permissions during the ajax_save_semantic_search_settings AJAX action. This allows authenticated ...

CVE-2026-104766

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress is vulnerable to Privilege Escalation in versions up to and including 5.7.3 . The root cause is that the OsSettingsController::update() handler iterates over attacker-supplied settings parameters without an allowlist...

CVE-2026-104741

The AI Puffer (formerly AI Power) plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 2.4.89 . The root cause is the plugin's failure to properly verify user permissions when accessing the ajax_save_cpt_indexing_options AJAX endpoint. This allows auth...

CVE-2026-104023

The Smart Popup by Supsystic plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.13.2 . The flaw exists in the 'sidx' parameter due to insufficient escaping of user-supplied input and a lack of proper SQL query preparation. This allows authenticated attackers...

CVE-2026-78068

The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.3.35 . The root cause is insufficient input sanitization and output escaping within the Table Cell Content. This allows authenticated attackers with...

CVE-2026-91050

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to and including 5.7.2 . The vulnerability exists in the publicly reachable steps__start and steps__load_step routes, which accept a params[p...

CVE-2026-18496

The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 11.4.3 . The flaw exists within the wpbc_is_show_popover_in_flex_timeline() function, which allows unauthenticated attackers to extract sensitive customer data, including ...

CVE-2026-89301

The rtMedia for WordPress, BuddyPress and bbPress plugin is vulnerable in all versions up to and including 4.7.13 due to insufficient file path validation in the process function. This flaw allows unauthenticated attackers to perform limited file deletion of arbitrary safe files on the server via...

CVE-2026-97670

The Avada (Fusion) Builder plugin for WordPress (versions up to and including 7.16.1 ) is vulnerable to an authorization bypass due to insufficient verification of a WordPress action hook name. Attackers can supply an arbitrary hook name via an attacker-supplied form-field value (specifically usi...

CVE-2026-104021

The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to and including 1.7.4 . The flaw exists in the fastcache_settings[cache_cookie_exclude][] parameter because the plugin registers the setting via register_setting() without a sanitize_callback. The bu...