2026

The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPress is vulnerable to

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Sc

The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kubio/copyright Block Co

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direc

The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypas

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in KA Informatics Tec

The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and inclu

The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in

The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.

The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is e

The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an acco

The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for

The GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI plugin for WordPress is v

The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.

The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a

The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before

The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request befo

The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scri

The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in its page-

The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plu

The Magazine Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the News Ticker block's client

The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to a

The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via the get_comments action in versions up to,

The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to,

An improper authentication vulnerability has been reported to affect product. The remote attackers can then exploit the

The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch

The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute before outputting it

The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using

The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauth

The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appoi

The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stor

The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when

The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ parameter from the Sigmative API in variou

The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site S

The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'css[left]' parameter in all

django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff acc

A vulnerability was determined in Freedesktop Poppler 26.07.0. This affects the function FoFiTrueType::mapCodeToGID of t

A vulnerability was found in Freedesktop Poppler 26.07.0. The impacted element is the function JBIG2Stream::readCodeTabl

The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolder

The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing

Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The D

The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without va

A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote insta

A flaw has been found in Freedesktop Poppler 26.07.0. Impacted is the function JBIG2Stream::rewind of the file poppler/J

A vulnerability was detected in Freedesktop Poppler 26.07.0. This issue affects the function SampledFunction::SampledFun

A vulnerability was identified in O-RAN-SC SMO OAM 2025-06-10. This affects an unknown part of the component VES Collect

Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plu