2026

The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in

The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a

The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in

The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before using it in SQ

The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them

The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bul

The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, a

The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query

The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a

The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL

The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it i

The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requ

The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settin

The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML

The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication pa

The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores

The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext pa

The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-cha

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before a

The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by

The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST endpoints, an

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allo

The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actio

The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing use

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allo

The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some o

The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user

The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request again

The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted th

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted thr

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through a

The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted throu

The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when u

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updatin

The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when upd

The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API

The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement

The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputt

The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputting it on a

The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in one

The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputtin

The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate

The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets bef

A vulnerability has been found in highwarden Super Store Finder up to 3.8. Affected is an unknown function of the file /

A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that t

The Squadeno WordPress plugin before 1.12.0 does not enforce its restrictions on every way a sport can be saved, allowi

The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleti