2026

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-medi

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's'

The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noti_token' parameter in a

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cro

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in al

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Path in all versions u

MISP contains a reflected cross-site scripting (XSS) vulnerability in the analyst data notes panel. The seed path parame

MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation fo

MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten op

MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time

colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote c

The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name (via /wp-admi

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress i

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress i

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripti

A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, in

The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication B

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the

The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all version

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up

MISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consumed HOTP (

A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. The impacted element is an unknown

The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation.

The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order

The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before ou

The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs durin

The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers

The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter before using it in a S

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5

The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor esc

The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before o

The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'styles.blocks' Block Type Key in al

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks befor

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbac

Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 expose a network-accessible m

Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side a

HCL Digital Experience is affected by improper input sanitation.  This can result in HTML injection which could be lever

The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in i

A vulnerability has been found in itsourcecode Leave Management System 1.0. The affected element is an unknown function

A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smart_fill of the file /global/c

A vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile

A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the funct

The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, tre

The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium WordPress plugi

The The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable

The WP Popular Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inc