2026

Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions.

Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions.

Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Te

Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions.

Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions.

Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions.

Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.

Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.

Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions.

Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions.

Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions.

Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.

Deserialization of Untrusted Data vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allo

Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.

Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions.

Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions.

Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.

Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

Subscriber Insecure Direct Object References (IDOR) in Webba Booking <= 6.5.0 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions.

Subscriber Insecure Direct Object References (IDOR) in Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0

Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.7 versions.

Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions.

Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 versions.

Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions.

Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite <= 6.5.1 versions.

Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 versions.

Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions.

Subscriber Privilege Escalation in FluentBoards <= 2.0.12 versions.

Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions.

Subscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 versions.

Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions.

Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions.

Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.

Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.

Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions.

Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.

Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.

Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the N

Observable response discrepancy vulnerability in Maksisoft Technology, IT, and Software Industry and Trade Inc. Maksisof

Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions.

Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons <= 1.14.11 versions.

Contributor Cross Site Scripting (XSS) in Happy Addons for Elementor <= 3.23.1 versions.

Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versions.

Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.

A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function db_properties of

A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file functio