2026

Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer for WooCommerce <= 3.1.5 versions.

Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.

Subscriber PHP Object Injection in WP User Frontend <= 4.3.10 versions.

Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue

In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a Cr

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generat

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters u

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEdit

In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs

reset_password.html parses query string parameters and uses the 'url' parameter as a redirection target (window.location

The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author URL / Link

Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus v

The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode_easywavefor

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcus Login With

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `redirect_url` parameter of the `et_pb

The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam sin

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not sanitise a user supplied list of iden

The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowin

The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by unauthenticated visit

The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site sig

The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX action

The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when s

The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment st

The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment st

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before retu

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before retu

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retriev

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its fr

The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store b

The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficien

The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returning a form's full stor

The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outputting

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the ob

The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the spe

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modif

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front en

The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using it

The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowi

The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API list

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value tak

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title befor

The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthen

The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves acr

The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the p

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized wh

The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints,