CVE-2026-9858

Partial Shipment for Woocommerce (WordPress plugin, versions ≤ 3.4) is vulnerable to Missing Authorization via the wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX actions. The root cause is that the AJAX handlers in woocommerce-partial-shipment.php (lines 228, 263, 291...

CVE-2026-1256

YS LeadGen – Popups, Opt-ins & Lead Capture for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.1.4 due to missing capability checks on popup management AJAX endpoints. Authenticated users with Subscriber-level or higher access can create arbitra...

CVE-2026-76579

LiteSpeed Cache for WordPress (all versions up to and including 7.9 ) contains a Reflected Cross-Site Scripting vulnerability in the ESI (esi) parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts by supplying a validly sign...

CVE-2026-9613

CVE-2026-9613 affects the Datalogics Ecommerce Delivery WordPress plugin in all versions up to and including 2.6.65 . The root cause is improper authorization verification in multiple AJAX actions (datalogics_create_shipping / datalogics_cancel_shipping), allowing authenticated users with subscri...

CVE-2026-1255

CVE-2026-1255 affects the YS LeadGen WordPress plugin (Popups, Opt-ins & Lead Capture) in all versions up to and including 2.1.4 . The vulnerability is an unauthenticated information disclosure in the ysleadgen_get_captured_data AJAX action, which is accessible without authentication. This allows...

CVE-2026-9289

WordLift – AI powered SEO – Schema plugin for WordPress (versions up to and including 3.54.10 ) is vulnerable to unauthenticated sensitive information exposure via its JSON-LD REST API endpoints (/wordlift/v1/jsonld/). The root cause is that these routes are registered with a permission_callback ...

CVE-2026-9766

The Empik for Woocommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.5.1 . The root cause is improper verification of user permissions in the empik_csv_process_emp_log_classes AJAX action, allowing any authenticated user with subscriber-level ...

CVE-2026-8354

Gum Addon for Elementor (WordPress plugin) is vulnerable to Stored Cross-Site Scripting (XSS) via the pop_tag parameter in the popover_btn widget, affecting all versions up to and including 1.3.15 . The root cause is insufficient input sanitization and output escaping, allowing authenticated user...

CVE-2026-18346

The TikTok for Business WordPress plugin (all versions up to 1.4.1 ) is vulnerable to authorization bypass via the auth_code parameter. The plugin fails to verify that the requester is authorized before processing a token exchange, allowing an unauthenticated attacker to overwrite the merchant's ...

CVE-2026-5410

The Redux Framework WordPress plugin (versions ≤ 4.5.13) is vulnerable to Stored Cross-Site Scripting via the spinner field. The root cause is twofold: the user_meta_save() function only sanitizes array values, so scalar spinner values bypass sanitization entirely, and class-redux-spinner.php (li...

CVE-2026-15098

The Real3D Flipbook Lite WordPress plugin (up to 5.1.1 ) has a Stored Cross-Site Scripting flaw in the on_shortcode() and print_global_options() functions. Shortcode attribute values (e.g. lightboxtext) are copied into $this->flipbook_options and emitted via wp_json_encode() inside a sequence...

CVE-2026-9855

The Custom Field Template plugin for WordPress is vulnerable to generic SQL Injection via the post_ID parameter in all versions up to and including 2.7.8 . The root cause is insufficient escaping on the user-supplied parameter and lack of preparation on the existing SQL query. The capability chec...

CVE-2026-1984

The Ibtana – Ecommerce Product Addons plugin for WordPress contains a missing capability check on the iepa_use_gt_editor AJAX action , affecting all versions up to and including 0.4.7.7 . An authenticated attacker with Subscriber-level access or higher can update or delete arbitrary post meta ent...

CVE-2026-87917

The MC4WP: Mailchimp for WordPress plugin (versions up to and including 4.14.0 ) is vulnerable to Reflected Cross-Site Scripting (XSS) via the 'data' Dynamic Content Tag , caused by insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts i...

CVE-2026-5400

CVE-2026-5400 is a Stored Cross-Site Scripting vulnerability in the Redux Framework plugin for WordPress, affecting versions up to and including 4.5.13 . The root cause is insufficient input sanitization of nested array values in the user_meta_save() function and unsafe output of filter CSS value...

CVE-2026-7527

The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is affected by an Open Redirect vulnerability in all versions up to and including 7.0.02 . The root cause is insufficient validation of user input, specifically through the redirect_to parameter. An unauthenticated attacke...

CVE-2026-85658

ProfilePress (Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content) for WordPress is vulnerable to arbitrary shortcode execution in all versions up to and including 4.17.2 . The root cause is improper validation of a value before passing it to do_...

CVE-2026-13200

The Create plugin for WordPress (by Mediavine) is vulnerable to generic SQL injection via the 'order' parameter in all versions up to and including 2.5.3 . The root cause is insufficient escaping and inadequate preparation of the SQL query. The vulnerable code path in the advanced-filter branch i...

CVE-2026-12402

CVE-2026-12402 affects the OTP Login & Register Woocommerce plugin for WordPress in all versions up to and including 2.7.3 . The vulnerability is a Stored Cross-Site Scripting (XSS) in the 'fb-config' Setting , caused by insufficient input sanitization and output escaping. An authenticated attack...

CVE-2026-75959

CVE-2026-75959 affects the GoPay for WooCommerce plugin for WordPress (all versions up to and including 1.0.36 ). The vulnerability is a SQL Injection in the log_table_filter parameter, caused by insufficient escaping of user-supplied input and lack of proper SQL query preparation. Authenticated ...