2026

The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Rev

The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST route

The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management RES

The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it

The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include

The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before out

The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read

The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before

The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allo

The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before out

The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTM

The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it

The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, all

The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting the

The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statemen

The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that the product fulfilled when a checkout is c

The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redi

The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in

The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthentic

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Ba

The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its AP

The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to du

The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its c

The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting

The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was iss

The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6.

The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the `image_src` attribute of the

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including,

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks w

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site S

The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'no

The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Field Value in all ver

The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versio

The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a se

The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3

The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before output

The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its admini

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-

PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursiv

The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15

The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored C

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored C

The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'consen

The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and includ

The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scri

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This ha