Wordpress

The SureCart WordPress plugin contains an authentication vulnerability in the VerificationCodeController REST endpoint, allowing unauthenticated attackers to brute-force verification codes to hijack user accounts.

The Contact Form Extender for Divi Builder plugin for WordPress contains an arbitrary file deletion vulnerability in versions 1.0.6 and below that allows unauthenticated attackers to delete sensitive files via the cfefd_remove_uploaded_file function.

The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to authenticated SQL injection via the tracking_provider parameter, allowing attackers with Shop Manager privileges to exfiltrate database contents.

The Easy Digital Downloads WordPress plugin is vulnerable to authentication bypass and account takeover due to insecure association of guest checkout orders with existing user accounts based on email address.

The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection via the render_field function.

The BuddyPress XProfile Image Field plugin for WordPress up to and including version 3.1.0 is vulnerable to arbitrary file deletion via unauthenticated registration metadata.

The Acadlix LMS plugin for WordPress is vulnerable to arbitrary file deletion in the post_delete_assessment_file_by_id function due to insufficient file path validation and an improper permission callback, allowing unauthenticated attackers to delete files on the server.

The WP Directory Kit WordPress plugin is vulnerable to unauthenticated SQL injection via the idfield parameter due to insufficient input sanitization, enabling potential data exfiltration.

An unauthenticated remote code execution vulnerability in the SimpleForm WordPress plugin (<= 3.10.2) allows attackers to bypass file validation via trailing-dot filenames and exploit publicly exposed nonces.

The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress contains a Stored Cross-Site Scripting vulnerability allowing unauthenticated attackers to inject arbitrary web scripts via the mail subject parameter.

An authentication bypass vulnerability in the Wp Social Login and Register Social Counter plugin allows unauthenticated attackers to impersonate any site user, including administrators, by spoofing OAuth email callbacks.

The Mail logging & Catcher plugin for WordPress (<= 2.2.0) contains an information exposure vulnerability allowing authenticated users to extract password-reset keys and escalate privileges to administrator.

The Welcart e-Commerce plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability via the 'gid' parameter, allowing unauthenticated attackers to execute arbitrary JavaScript in the administrative dashboard.

The Relevanssi - A Better Search plugin for WordPress (v4.28.5 and earlier) is vulnerable to stored cross-site scripting (XSS) via the comment parameter, allowing unauthenticated attackers to execute arbitrary scripts when specific search-highlighting features are enabled.

The VikRentCar WordPress plugin contains a stored XSS vulnerability in the poplink parameter that is exploitable by unauthenticated attackers due to the public exposure of the vikwp_nonce token.

The PPWP Password Protect Pages plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting via improper input sanitization in shortcode attributes, allowing script injection into pages.

The Ninja Forms WordPress plugin is vulnerable to stored cross-site scripting (XSS) due to improper input sanitization and a flawed nonce implementation in the nf_ajax_submit endpoint, allowing unauthenticated attackers to execute arbitrary web scripts.

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post_content parameter, allowing unauthenticated attackers to execute arbitrary JavaScript if specific plugin settings are enabled.

The Popup Builder WordPress plugin contains an authorization bypass vulnerability (CVE-2026-89270) that allows unauthenticated attackers to bulk delete published popups via a crafted GET request.

Mail Mint versions 1.31.0 and earlier contain an unauthenticated PHP object injection vulnerability in the REST API endpoint /mint-form-submit that allows remote attackers to trigger arbitrary object instantiation.

An unauthenticated file upload vulnerability in the Checkout Files Upload for WooCommerce plugin allows remote attackers to execute arbitrary PHP code due to improper file type validation and exposed AJAX handlers.

An authenticated administrator can exploit an unescaped URL parameter in the WordPress Premium Packages plugin (<= 5.9.6) to perform time-based blind SQL injection and exfiltrate database information.

The Formidable Forms WordPress plugin is vulnerable to arbitrary plugin installation via the 'file_url' parameter in versions up to and including 6.35.

Gravity Forms for WordPress versions up to and including 3.1.2 is vulnerable to unauthenticated PHP object injection via Post Custom Fields, which can lead to remote code execution when combined with specific gadget chains.

The Content Egg plugin for WordPress contains a stored XSS vulnerability (CVE-2026-92424) allowing contributor-level users to inject malicious scripts into posts by impersonating an administrator during the import process.

Bold Grid W3 Total Cache versions from n/a through 2.10.7 contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability, which allows Stored XSS.

A contributor PHP object injection vulnerability exists in the Dynamic QR Code - generator WordPress plugin, affecting versions 1.0.1 and earlier.

Multiple vulnerabilities in WordPress versions prior to 7.1.4 allow remote attackers to execute arbitrary code, conduct denial-of-service, perform unauthorized data access, and bypass security policies.

WP Crowdfunding versions 2.2.2 and earlier contain an unauthenticated sensitive data exposure vulnerability.

The Extra Fees Plugin for WooCommerce versions 4.4.0 and below contains a contributor-level PHP object injection vulnerability.

A reflected cross-site scripting vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce (versions <= 3.1.6) allows attackers to execute arbitrary scripts in a user's browser via crafted input.

The Login with phone number plugin for WordPress is vulnerable to authentication abuse due to weak authentication mechanisms, affecting versions up to and including 1.8.78.

The VideoWhisper Broadcast Live Video WordPress plugin contains a missing authorization vulnerability (CVE-2026-115963) in versions up to 7.3.9, allowing unauthorized users to bypass access control checks.

A session hijacking vulnerability in Two Factor Authentication and All-In-One Security (AIOS) WordPress plugins allows attackers to bypass MFA by providing their own valid 2FA code during a victim's login process.

The NewsmanApp WordPress plugin contains a stored Cross-Site Scripting vulnerability in billing parameters that allows unauthenticated attackers to execute arbitrary scripts in the context of a user session.

The Newsmatic theme for WordPress is vulnerable to unauthenticated blind SQL injection in the slug parameter, allowing remote attackers to extract sensitive database information.

The Mapster WP Maps plugin for WordPress up to version 2.0.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts into map configurations via the REST API.

The Ortto plugin for WordPress versions prior to 1.0.25 contains an authentication bypass vulnerability that allows unauthenticated attackers to overwrite plugin configurations via exposed secrets, enabling the injection of arbitrary scripts.

The Schema App Structured Data plugin for WordPress through version 2.3.2 is vulnerable to stored cross-site scripting due to insufficient sanitization of comment content when the 'Remove Microdata' feature is active.

The DSGVO All in one for WP plugin for WordPress is vulnerable to stored cross-site scripting (XSS) due to improper sanitization of comment content when specific integration settings are enabled.

The Social Web Suite WordPress plugin (up to 4.1.12) is vulnerable to unauthenticated SQL injection via the exclude_posts parameter and an authentication bypass due to insecure default HMAC secret key handling.

The Wild Apricot Login plugin for WordPress (<= 1.0.18) is vulnerable to authentication bypass where attackers can hijack administrative sessions by binding malicious WildApricot accounts to existing WordPress user emails via insecure SSO account mapping.

The Eniture LTL Freight Quotes - Old Dominion Edition WordPress plugin (versions 4.2.10 and below) is vulnerable to unauthenticated SQL injection via the 'edit_id' and 'dropship_edit_id' parameters. Public exploit code is available on Sploitus.

CVE-2024-51791 is an unauthenticated arbitrary file upload vulnerability in the Made I.T. Forms WordPress plugin allowing remote code execution via a PHP web shell.

An unauthenticated SQL injection vulnerability in TI WooCommerce Wishlist versions 2.8.2 and earlier allows remote attackers to execute arbitrary SQL commands via the order parameter, facilitating potential database compromise and sensitive data exposure.

An authentication bypass vulnerability in the Really Simple Security WordPress plugin (versions 9.0.0-9.1.1.1) allows unauthenticated attackers to gain administrative access via the REST API.

An authenticated remote code execution vulnerability (CVE-2020-36842) in the WPvivid WordPress plugin allows low-privileged users to achieve code execution via ZIP archive file uploads.

The VikRentCar plugin for WordPress (<= 1.4.8) contains a CSRF vulnerability in the condtext_update_tmpl function that permits unauthenticated attackers to achieve remote code execution by injecting PHP code into template files.

The Prime Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization, allowing unauthenticated attackers to inject malicious HTML attributes that execute in the context of victim browsers.

The MxChat AI Chatbot plugin for WordPress is vulnerable to unauthenticated stored DOM-based XSS, allowing script injection via the feedback parameter that executes in an administrator's session.

The Innovative Form Builder - IvyForms plugin for WordPress contains an arbitrary file upload vulnerability via the filterFiletypeAndExt function.

The Mage Eventpress WordPress plugin is vulnerable to privilege escalation in versions 5.7.8 and earlier due to improper request parameter validation in the mep_grant_shop_manager_access function.

The Product Designer for WooCommerce plugin (<= 2.1.2) contains a directory traversal vulnerability that allows unauthenticated attackers to read arbitrary server files by leveraging a predictable security nonce.

The Rank Math SEO plugin for WordPress is vulnerable to PHP object injection via the updateMeta REST API endpoint, allowing authenticated contributors to achieve remote code execution through POP chain exploitation.

The affiliate-toolkit WordPress plugin contains a stored XSS vulnerability in the atkp_product_producturl parameter, allowing unauthenticated or contributor-level attackers to inject arbitrary web scripts.

The Pie Register Premium WordPress plugin contains an unrestricted file upload vulnerability in the piereg_file_upload function that allows unauthenticated attackers to achieve remote code execution.

The MembershipWorks WordPress plugin prior to version 6.17 fails to enforce content protection filters on WordPress REST API requests, allowing unauthenticated attackers to retrieve restricted member-only content.

A critical unauthenticated arbitrary file upload vulnerability in the WordPress plugin midi-Synth (CVE-2026-1306) allows remote attackers to achieve full server compromise by uploading and executing arbitrary PHP files via the admin-ajax.php endpoint.

CVE-2026-1277 is an unauthenticated open redirect vulnerability in the URL Shortify WordPress plugin that allows attackers to redirect users to malicious websites via a crafted redirect_to parameter.

An authenticated PHP object injection vulnerability in the Kirki WordPress plugin allows attackers with subscriber-level access to escalate privileges to administrator via a POP chain.

The aBlocks WordPress plugin fails to validate user input within the /ablocks/v1/form-builder/registration REST endpoint, allowing authenticated users with Contributor access to escalate privileges to Editor.

An unauthenticated blind SQL injection vulnerability (CVE-2026-112866) exists in the Product Filter by WBW WordPress plugin, allowing attackers to access database information via the plugin frontend.

The User Profile Builder plugin for WordPress is vulnerable to privilege escalation because it fails to authorize the role assignment attribute in the Gutenberg Register block, allowing authenticated users to register accounts with higher-privileged roles.

The Ally Web Accessibility plugin for WordPress is vulnerable to unauthenticated time-based blind SQL injection in the get_global_remediations() method.

The WP User Frontend Pro WordPress plugin is vulnerable to arbitrary file upload via the upload_files function, allowing authenticated attackers to achieve remote code execution.

The Music Store WordPress plugin version 1.4.7 and earlier contains a directory traversal vulnerability in the f parameter, allowing unauthenticated attackers with a valid purchase_id to read arbitrary files from the server.

The Anti-Spam by CleanTalk plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability allowing unauthenticated attackers to execute arbitrary scripts in an administrator's browser session via the 'user_email' parameter.

CVE-2024-0235 is an unauthenticated information disclosure vulnerability in the Myeventon Eventon plugin that allows remote attackers to enumerate user email addresses via the 'eventon_get_virtual_users' AJAX action.

The JetBackup WordPress plugin before 3.1.24.10 is vulnerable to an arbitrary file write attack via malicious symbolic links in backup archives, allowing authenticated administrators to achieve remote code execution.

CVE-2023-5359 is a cleartext credential storage vulnerability in W3 Total Cache versions 2.7.5 and earlier that allows unauthenticated remote attackers to retrieve API keys and OAuth secrets via direct HTTP requests to plugin PHP files.

The Broadstreet Ad Widget WordPress plugin (versions 2.2.0 through 2.11.9) is vulnerable to authenticated local file inclusion via directory traversal in the 'step' parameter, allowing for arbitrary PHP code execution.

The Javo Spot WordPress theme before version 3.0.0 is vulnerable to unauthenticated path traversal via the jvfrm_spot_get_json AJAX action, allowing attackers to read sensitive files like wp-config.php.

The CozyThemes Rootblox plugin for WordPress, versions 1.0.6 and earlier, contains a Local File Inclusion vulnerability that allows unauthenticated remote attackers to include arbitrary files, potentially leading to remote code execution.

The Jane Menu WordPress plugin prior to 1.5.1 contains a vulnerability allowing unauthenticated attackers to perform Stored Cross-Site Scripting via improper capability and nonce checks in a form handler.

Cherry Plugin for WordPress versions before 1.2.7 contain a path traversal vulnerability in the import-export module that allows unauthenticated attackers to read arbitrary files from the web server.

The Issuu Panel plugin for WordPress before 1.6.6 is susceptible to unauthenticated remote and local file inclusion via the abspath parameter, enabling arbitrary PHP code execution.

The Memphis Documents Library plugin for WordPress is vulnerable to path traversal via the mdocs-img-preview parameter, allowing unauthenticated attackers to read arbitrary files.

The Aspose Importer & Exporter WordPress plugin before 3.0 contains a path traversal vulnerability allowing unauthenticated attackers to read sensitive files via the file parameter.

The Aspose Doc Exporter WordPress plugin before version 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files from the server.

The ChurcHope theme for WordPress before version 2.2 is vulnerable to an unauthenticated path traversal attack, allowing remote adversaries to read arbitrary files from the host server.

The NativeChurch WordPress theme before version 1.6.2 is vulnerable to unauthenticated path traversal via the download.php file parameter, allowing for the arbitrary download of sensitive system files.

The TinyMCE Thumbnail Gallery WordPress plugin versions prior to 1.1.0 are vulnerable to unauthenticated path traversal via the href parameter, allowing remote attackers to read arbitrary system files.

A Cross-Site Request Forgery (CSRF) vulnerability in the VikRentCar WordPress plugin (versions 1.4.8 and earlier) allows unauthenticated attackers to perform unauthorized administrative actions.

An arbitrary file upload vulnerability in the WordPress ACF City Selector plugin (<= 1.14.0) allows an authenticated administrator to achieve remote code execution by uploading a malicious PHP shell.

A supply-chain compromise of Rank Math SEO PRO version 3.0.123, distributed between October 15 and 16, 2026, introduced a backdoor enabling persistent access, credential theft, and unauthorized administrative control.

Attackers compromised Rank Math PRO version 3.0.123 between October 15 and October 16, 2026, injecting malware that provides persistent administrative access, credential theft, and server-side backdoor capabilities.

A deserialization of untrusted data vulnerability in the Quiz And Survey Master WordPress plugin (CVE-2026-111408) allows for object injection, potentially leading to arbitrary code execution.

A path traversal vulnerability in the MapSVG plugin, tracked as CVE-2026-111398, allows unauthenticated attackers to read arbitrary files from the hosting server.

CVE-2026-110887 is a critical code injection vulnerability in the HivePress WordPress plugin that permits unauthenticated remote code inclusion.

The Quiz Maker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper input sanitization, potentially allowing attackers to execute arbitrary scripts in a user’s browser.

CVE-2026-110897 is a stored Cross-Site Scripting (XSS) vulnerability in the PowerPack Lite for Beaver Builder WordPress plugin that allows unauthenticated or low-privileged attackers to execute arbitrary scripts in a victim's browser session.

CVE-2026-110383 is an authorization bypass vulnerability in the Electronic Signature Add-on for Fluent Forms that permits attackers to manipulate access control levels due to improper user-controlled key handling.

A stored cross-site scripting (XSS) vulnerability (CVE-2026-110382) in the Simply Schedule Appointments WordPress plugin allows unauthenticated or low-privileged users to inject malicious scripts into administrative pages.

CVE-2026-109894 is a critical SQL injection vulnerability in the Arraytics Booktics plugin that allows unauthenticated attackers to execute arbitrary database queries.

A deserialization of untrusted data vulnerability (CVE-2026-107436) in the WP Chill Strong Testimonials plugin allows remote attackers to perform object injection, potentially leading to remote code execution.

An unauthenticated stored XSS vulnerability in the User Registration & Membership plugin allows attackers to inject arbitrary scripts via the checkbox field due to missing nonce validation.

The User Registration & Membership plugin for WordPress is vulnerable to unauthenticated arbitrary shortcode execution due to insufficient sanitization of the HTTP_REFERER header.

An authorization bypass vulnerability in the WP Booking System plugin allows authenticated subscribers to access sensitive booking email logs by manipulating request parameters, exposing PII.

An unauthenticated Stored Cross-Site Scripting vulnerability in The EU VAT Assistant for WooCommerce plugin (<= 2.1.30.260413) allows attackers to inject malicious scripts that execute in the administrator's context, potentially leading to account takeover.

The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting via the 'quantity' and 'order_comments' parameters, allowing script injection by unauthenticated or low-privileged users.

The Kirki WordPress plugin is vulnerable to PHP Object Injection in versions 6.3.2 and earlier, allowing authenticated users with Editor or Administrator access to trigger deserialization of untrusted input.

The LearnPress plugin for WordPress is vulnerable to unauthenticated PHP Object Injection via the 'checkout-email' parameter, allowing remote attackers to trigger insecure deserialization.

The WP Sessions Time Monitoring Full Automatic WordPress plugin up to version 1.1.5 is vulnerable to stored XSS via multiple input parameters, allowing unauthenticated attackers to execute arbitrary scripts in the context of user sessions.

The Vitepos plugin for WooCommerce is vulnerable to unauthenticated SQL injection via the 'src_by' parameter, potentially allowing unauthorized database information extraction.

An arbitrary file upload vulnerability in the DoubleScale CRM plugin for WordPress up to version 1.5.1 allows authenticated subscribers to achieve remote code execution when the Helpdesk module is enabled.

An unauthenticated stored cross-site scripting vulnerability in the User Registration PRO premium WordPress plugin allows attackers to inject malicious scripts via the HTTP Referer header.

An authentication bypass vulnerability (CVE-2026-75903) in the Vulnity Security plugin for WordPress allows unauthenticated attackers to retrieve credentials and gain administrative access via misconfigured Nginx path restrictions.

The WPConsent WordPress plugin up to version 1.1.9 is vulnerable to stored Cross-Site Scripting (XSS) via mXSS, allowing unauthenticated attackers to execute arbitrary scripts in a user's browser session.

An unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in HivePress plugin versions 1.7.32 and earlier allows attackers to inject malicious scripts into attribute fields.

The Search Regex WordPress plugin version 3.5 is vulnerable to PHP Object Injection, allowing authenticated users with subscriber access to achieve remote code execution via a POP chain.

The Sunshine Photo Cart plugin for WordPress is vulnerable to unauthenticated PHP object injection in versions up to 3.7.4, which can be leveraged for RCE if secondary plugins provide a viable POP chain.

An unauthenticated account takeover vulnerability in the Theme My Login WordPress plugin allows attackers to change arbitrary user passwords due to improper identity validation.

The PilotPress WordPress plugin (<= 2.0.43) contains a logic flaw in the update_cc_details() AJAX handler that allows an authenticated attacker to trigger an administrative account takeover.

An unauthenticated Stored XSS vulnerability in the Salon Booking System WordPress plugin allows attackers to inject malicious scripts into checkout fields.

The SiteOrigin CSS WordPress plugin contains a stored DOM-based XSS vulnerability via the 'url' parameter, allowing unauthenticated attackers to execute arbitrary web scripts.

The Simply Schedule Appointments WordPress plugin is vulnerable to stored XSS via the 'status' parameter, allowing unauthenticated attackers to execute arbitrary scripts in an administrator's browser session.

The Nexter Extension plugin for WordPress is vulnerable to privilege escalation (CVE-2026-111114) allowing authenticated users to restore elevated roles due to improper state cleanup during bulk demotions.

The InstaWP Connect plugin for WordPress, versions 0.1.4.1 and earlier, contains a privilege escalation vulnerability allowing authenticated users to extract the master API key and mint administrator session tokens.

The Groundhogg WordPress plugin contains an arbitrary file deletion vulnerability in the copy_file function that allows authenticated users with specific capabilities to remove critical server files.

The Modula Image Gallery plugin for WordPress is vulnerable to unauthenticated information exposure via the REST API, allowing attackers to retrieve plaintext credentials for password-protected galleries.

An authentication bypass vulnerability in the miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress allows unauthenticated attackers to hijack user sessions.

The ELEX WordPress HelpDesk & Customer Ticketing System plugin is vulnerable to unauthenticated arbitrary file upload in the initMailPart function, potentially leading to remote code execution.

An arbitrary file upload vulnerability in the Mang Board plugin for WordPress allows unauthenticated attackers to achieve remote code execution by bypassing extension validation.

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress (<= 7.5.5) is vulnerable to Stored XSS due to improper input sanitization, allowing unauthenticated attackers to execute arbitrary scripts via comment content.

The Backuply plugin for WordPress is vulnerable to second-order SQL injection, allowing authenticated attackers to achieve privilege escalation through malicious backup restoration.

An unauthenticated stored XSS vulnerability in the Flying Scripts WordPress plugin (CVE-2026-109990) allows attackers to execute arbitrary JavaScript by bypassing core sanitization through an output-buffer rewriter.

The RSS Aggregator by Feedzy WordPress plugin is vulnerable to Stored Cross-Site Scripting via malicious RSS feed input, allowing unauthenticated attackers to execute arbitrary scripts in the context of the target site.

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to unauthenticated privilege escalation due to insufficient entropy in activation token generation when configured to use the 'hashids' encoding method.

WooCommerce Designer Pro version 1.9.26 and earlier is vulnerable to unauthenticated arbitrary file upload due to insufficient validation in the wcdp_save_canvas_design_ajax function, facilitating remote code execution.

An authenticated RCE vulnerability in the Email Customizer for WooCommerce plugin allows subscriber-level users to inject and execute arbitrary PHP code.

The Mang Board WP plugin for WordPress through version 2.4.0 is vulnerable to stored cross-site scripting (XSS) via the 'data_type' parameter, allowing unauthenticated attackers to execute arbitrary scripts in victim browsers.

The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to unauthenticated stored cross-site scripting (XSS) via the 'order_email' parameter due to insufficient input validation.

The Checkout Field Manager plugin for WordPress contains an authorization bypass vulnerability allowing low-privileged authenticated users to delete arbitrary files from the Media Library.

The Link Library plugin for WordPress is vulnerable to unauthenticated time-based SQL injection via the 'link_url' parameter, enabling potential database information exfiltration.

The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery via insecure Host header processing, allowing unauthenticated attackers to bypass URL allowlists and perform unauthorized requests.

An unauthenticated remote code execution vulnerability exists in 10Web Booster versions 2.34.10 and earlier due to insecure file handling and nonce leakage.

An unauthenticated authentication bypass vulnerability (CVE-2026-97657) in Abandoned Cart Pro for WooCommerce versions 10.8.0 and earlier allows attackers to perform account takeovers via XOR-malleation of recovery tokens.

The JTL-Connector for WooCommerce WordPress plugin is vulnerable to unauthenticated remote code execution via a flaw in session handling and file validation.

The Snazzy Social Media Feed WordPress plugin (up to version 2.5) is susceptible to arbitrary file upload and remote code execution via insufficient sanitization in the standalone save-to-cache.php script.

An unauthenticated arbitrary shortcode execution vulnerability in Click to Chat for WhatsApp for WordPress allows attackers to trigger malicious shortcodes by manipulating the REQUEST_URI.

The MultiVendorX WordPress plugin through version 5.0.19 contains an authorization bypass vulnerability allowing authenticated store owners to modify global marketplace settings via the REST API.

The Divi Plus WordPress plugin contains an arbitrary file read vulnerability (CVE-2026-91136) in the SVG animator REST endpoint that allows unauthenticated attackers to exfiltrate sensitive server files.

The HivePress WordPress plugin for versions 1.7.31 and below contains a stored Cross-Site Scripting (XSS) vulnerability that allows unauthenticated attackers to execute arbitrary scripts in the context of user profiles.

An unauthenticated SQL injection vulnerability in the LatePoint Appointment Booking Plugin allows remote attackers to extract sensitive database information via the booking[service_id] parameter.

An unauthenticated IDOR vulnerability in the WebToffee WooCommerce PDF Invoices plugin allows attackers to retrieve sensitive customer order documents by supplying a known email address.

An authentication bypass vulnerability in the WPO365 Login plugin allows unauthenticated attackers to hijack user sessions by replaying previously issued OIDC tokens.

The WPAdverts plugin for WordPress contains a stored XSS vulnerability (CVE-2026-100178) that allows unauthenticated attackers to inject malicious scripts via the 'adverts_location' parameter.

An authentication bypass vulnerability (CVE-2026-104803) in the WPCOM Member WordPress plugin allows unauthenticated attackers to hijack user sessions, including administrative accounts, by exploiting insufficient nonce and session validation in the social-login callback handler.

The WP Meteor Website Speed Optimization Addon for WordPress versions 3.4.18 and earlier contains a Stored XSS vulnerability allowing unauthenticated attackers to inject malicious scripts via the comment author name field.

The VikBooking Hotel Booking Engine & PMS plugin for WordPress up to version 1.8.15 contains a Stored XSS vulnerability in the 'attachments[name]' parameter that allows unauthenticated attackers to inject malicious scripts.

An authorization bypass vulnerability in WP File Download allows authenticated users with subscriber-level access to delete or manipulate managed files.

The Bookly plugin for WordPress contains a PHP Object Injection vulnerability in versions 28.2 and earlier, allowing authenticated users with custom-level access to inject arbitrary PHP objects.

The LazyLoad Plugin for WordPress up to version 2.4.0 is vulnerable to Stored Cross-Site Scripting (XSS) due to improper sanitization of the comment_content parameter, allowing attackers to inject malicious scripts that execute upon administrator approval.

The Presto Player WordPress plugin is vulnerable to Stored Cross-Site Scripting via the presto-player tag, allowing unauthenticated attackers to execute arbitrary web scripts.

The Real Estate Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization of the first_name parameter, allowing unauthenticated attackers to bypass reCAPTCHA and execute arbitrary scripts.

The Podlove Podcast Publisher plugin for WordPress contains an unauthenticated Stored XSS vulnerability in the Auphonic Webhook implementation, allowing for arbitrary script injection via crafted POST requests.

An unauthenticated stored XSS vulnerability in the Easy Digital Downloads WordPress plugin allows attackers to inject malicious scripts via PayPal IPN parameters.

The GeoDirectory plugin for WordPress is vulnerable to unauthenticated local file inclusion (LFI) via the design_type parameter, allowing remote attackers to execute arbitrary PHP code.

The PPOM - Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to unauthenticated arbitrary file deletion and reading via improper path validation in the rename_files function, facilitating potential RCE.

The rtMedia for WordPress plugin contains a vulnerability in the 'process' function allowing unauthenticated attackers to delete arbitrary files on the server by leveraging exposed nonces.

CVE-2026-104797 allows unauthenticated attackers to change the passwords of any WordPress user, including administrators, via an unverified profile update action in the Advanced Form Integration plugin.

An unauthenticated authorization bypass in the Avada Fusion Builder plugin for WordPress allows attackers to trigger arbitrary action hooks via crafted AJAX form submissions.

The Extensions For CF7 WordPress plugin is vulnerable to unauthenticated remote code execution via arbitrary file upload due to insufficient input validation in the extcf7_submit function.

The Blocksy Companion WordPress plugin is vulnerable to unauthenticated privilege escalation, allowing attackers to create arbitrary vendor accounts by bypassing Dokan registration security checks.

An authentication bypass vulnerability in the Advanced IP Blocker WordPress plugin enables unauthenticated attackers to brute-force MFA tokens and achieve complete site takeover via reusable nonces and lack of rate limiting.

The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress are vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization in the Popup Builder's save_popup_content AJAX action.

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload via the 'temporaryFileUploads' parameter in versions up to 3.1.8.9, enabling remote code execution.

Unauthenticated attackers can achieve arbitrary recursive directory deletion in Super Forms versions 6.3.316 and earlier by exploiting improper path validation in the submit_form function.

Authenticated attackers can exploit a PHP Object Injection vulnerability in Uncanny Automator versions 7.6.1.1 and earlier to achieve arbitrary file deletion via a POP chain.

An unauthenticated arbitrary file upload vulnerability (CVE-2026-81780) in the Hash Form WordPress plugin allows attackers to achieve remote code execution through the 'admin-ajax.php' endpoint.

Authenticated attackers with subscriber-level access can achieve remote code execution in ACPT (Premium) versions up to 2.0.66 by injecting malicious Twig expressions via the REST API.

The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the user_email parameter, allowing unauthenticated attackers to execute arbitrary scripts in the context of administrative log views.

The WP Visitor Statistics plugin (up to 8.7) is vulnerable to a second-order SQL injection allowing unauthenticated attackers to exfiltrate database information via the 'fullRef' parameter.

An authorization bypass vulnerability in the Nelio Content WordPress plugin allows authenticated contributors to delete arbitrary reusable social messages.

The WP Mail Catcher plugin for WordPress is vulnerable to stored cross-site scripting (XSS) via inadequate sanitization of PHPMailer error messages, allowing unauthenticated attackers to execute arbitrary scripts in the context of administrative sessions.

The WPCafe WordPress plugin contains a local file inclusion vulnerability in its template scope function, allowing authenticated contributors to execute arbitrary PHP files.

Beaver Builder Page Builder for WordPress (<= 2.11.0.5) is vulnerable to unauthenticated arbitrary shortcode execution via improper input validation in the Sidebar module.

The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to unauthenticated arbitrary file deletion via insufficient path validation in the extract function, which can lead to remote code execution.

The Simple Membership plugin for WordPress is vulnerable to unauthenticated account activation and credential disclosure due to insufficient input validation in activation-related endpoints.

The Strong Testimonials WordPress plugin (up to version 3.3.11) is vulnerable to stored Cross-Site Scripting (XSS) via the 'platform_user_photo' custom field, allowing unauthenticated attackers to execute malicious scripts in victims' browsers.

An unauthenticated stored XSS vulnerability in The Transliterator plugin (<= 2.5.8) allows attackers to inject malicious JavaScript into WordPress comments, leading to arbitrary code execution in the context of site viewers.

A stored XSS vulnerability in SEOPress versions up to 10.2 allows unauthenticated attackers to execute arbitrary scripts by injecting malicious code into the Author Display Name field.

An unauthenticated Stored Cross-Site Scripting vulnerability in the GD Rating System plugin for WordPress allows attackers to execute arbitrary JavaScript via the gdrts_live_handler AJAX action by bypassing a trivially accessible nonce.

An unauthenticated stored Cross-Site Scripting vulnerability in the Welcart e-Commerce WordPress plugin allows attackers to inject malicious scripts via settlement notification parameters.

The GeoDirectory WordPress plugin (<= 2.8.186) is vulnerable to SQL injection, allowing authenticated attackers to execute arbitrary database queries via improper coordinate sanitization in the geodir_gps_query_part function.

The Real Cookie Banner plugin (<= 5.3.5) for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via inadequate input sanitization in comment anchor tags, allowing unauthenticated attackers to execute arbitrary scripts in the browser context of site visitors.

The ProfilePress plugin for WordPress (<= 4.17.4) is vulnerable to sensitive information exposure, allowing authenticated and unauthenticated attackers to extract user PII via crafted shortcode parameters.

The Ultimate Member WordPress plugin (<= 2.13.1) contains a stored XSS vulnerability in the form_id parameter, allowing unauthenticated attackers to execute arbitrary scripts in the administrator dashboard.

The CodeArt Google MP3 Audio Player plugin for WordPress contains an unauthenticated path-traversal vulnerability in direct_download.php that allows remote attackers to read sensitive configuration files.

An unauthenticated stored XSS vulnerability in the JetAppointment WordPress plugin allows attackers to inject malicious scripts via the friendlyTime parameter that execute in an administrator's browser context.

The W3 Total Cache plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability, CVE-2026-87920, allowing unauthenticated attackers to execute arbitrary web scripts via flawed Output-Buffer Regex rewriting.

The CMB2 plugin for WordPress (<= 2.13.0) is vulnerable to Stored XSS via the file_list field type, allowing unauthenticated attackers to inject malicious scripts into public-facing forms or user meta boxes.

The GSpeech TTS plugin for WordPress (<= 3.22.0) is vulnerable to Stored Cross-Site Scripting via improper input sanitization and output-buffer manipulation, allowing unauthenticated attackers to execute arbitrary JavaScript.

The MW WP Form WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient sanitization of the 'post_id' parameter, enabling unauthenticated attackers to bypass CSRF protections and execute arbitrary scripts in victim sessions.

The Relevanssi plugin for WordPress is vulnerable to stored Cross-Site Scripting (XSS) due to insufficient input sanitization of comment content, allowing unauthenticated attackers to execute arbitrary scripts.

An unauthenticated stored XSS vulnerability in the JetFormBuilder WordPress plugin allows attackers to inject arbitrary web scripts via the 'choice' Post Meta field.

The Mang Board plugin for WordPress (<= 2.4.2) is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) via the 'data_type' parameter, allowing attackers to inject malicious scripts that execute in the context of user browsers.

The Newsletter plugin for WordPress versions <= 9.4.0 is vulnerable to Stored XSS via the 'np1' parameter, allowing unauthenticated attackers to execute arbitrary scripts due to missing input sanitization and endpoint security controls.

The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization, allowing unauthenticated attackers to execute arbitrary scripts in the browsers of site visitors.

The No External Links WordPress plugin (<= 5.2.0) is vulnerable to Stored Cross-Site Scripting (XSS) via the /goto/ redirect feature, allowing unauthenticated attackers to inject malicious scripts.

The Smash Balloon Social Post Feed WordPress plugin is vulnerable to Stored XSS that can be escalated to arbitrary plugin installation and remote code execution.

The Download Monitor plugin for WordPress versions up to 5.2.10 is vulnerable to Stored Cross-Site Scripting via a malicious postMessage injection that executes when an administrator interacts with a compromised download object.

The Kubio AI Page Builder plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability in the 'comment' parameter, allowing unauthenticated attackers to execute arbitrary scripts in the context of victim browsers.

The BA Book Everything plugin for WordPress contains a Stored XSS vulnerability in the booking_service_qty parameter, allowing unauthenticated attackers to execute arbitrary scripts in the context of an administrator.

An authentication bypass vulnerability in the WordPress JSON API Auth plugin allows unauthenticated attackers to hijack administrative sessions via cached HTTP responses.

The Ninja Forms File Uploads plugin for WordPress contains an unauthenticated vulnerability in the Amazon S3 upload flow that allows arbitrary file read, write, and deletion via insufficient path validation.

Authenticated attackers with contributor-level access can exploit a Local File Inclusion vulnerability in the SiteOrigin Widgets Bundle WordPress plugin to execute arbitrary PHP code via the REST API.

The Ninja Forms WordPress plugin versions 3.15.4 and earlier contain a stored Cross-Site Scripting vulnerability allowing unauthenticated attackers to inject malicious scripts via Paragraph Text fields with Rich Text Editor enabled.

The CTX Feed Pro WordPress plugin contains a code injection vulnerability (CVE-2026-10026) allowing authenticated administrators to achieve remote code execution via insufficient input validation.

The Visitors Traffic Real Time Statistics Pro WordPress plugin contains an unauthenticated stored XSS vulnerability allowing remote attackers to execute arbitrary JavaScript in the context of an administrator's browser.

The Forminator Forms plugin for WordPress is vulnerable to Stored XSS via the 'postdata-1[post-custom]' parameter in versions 1.57.2 and below, allowing unauthenticated attackers to execute arbitrary scripts.

The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization in the gateway field.

The Form Maker by 10Web WordPress plugin contains a stored cross-site scripting vulnerability in longitude and latitude fields that allows unauthenticated attackers to execute arbitrary scripts in the context of other users.

The Appointment Hour Booking plugin for WordPress is vulnerable to Stored DOM-based XSS via the Schedule Calendar List Renderer due to insufficient input sanitization, allowing unauthenticated attackers to execute arbitrary scripts.

An improper role validation vulnerability in the WPC Shop as a Customer for WooCommerce plugin allows authenticated attackers to perform account takeover and gain administrative access via the wpcsa_login endpoint.

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via billing fields, allowing unauthenticated attackers to execute arbitrary scripts in administrative sessions.

An unauthenticated IDOR vulnerability in the LearnPress WordPress plugin allows unauthorized access to private course materials by manipulating the course and item identifiers in AJAX requests.

The ByteCoreStack MCP Connector for AI Tools plugin for WordPress is vulnerable to privilege escalation via insufficient meta key validation, allowing Subscriber-level users to escalate to Administrator.

An authentication bypass vulnerability in The Ultimate Multisite plugin allows unauthenticated attackers to log in as any WordPress user, including administrators, by manipulating the AJAX checkout process.

An unauthenticated privilege escalation vulnerability (CVE-2026-15989) in the Super Forms WordPress plugin allows attackers to register administrative accounts via registration form injection.

The Extendify plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) via the 'styles.blocks' parameter, allowing arbitrary script injection.

The LatePoint WordPress plugin is vulnerable to unauthenticated arbitrary shortcode execution due to improper input validation during the booking flow.

The AI Engine plugin for WordPress is vulnerable to Stored Cross-Site Scripting, allowing unauthenticated attackers to achieve arbitrary script execution in an administrator's browser session.

An unauthenticated stored XSS vulnerability in the Post Views Stats Counter WordPress plugin (<= 1.1.7) allows attackers to inject malicious JavaScript into the administrator's dashboard via the User-Agent header.

The Product Designer App plugin for WordPress up to version 1.1.3 is vulnerable to directory traversal allowing unauthenticated file read due to insecurely implemented authentication using publicly exposed tokens.

The Motors - Car Dealership & Classified Listings WordPress plugin is vulnerable to unauthenticated time-based blind SQL injection in versions up to 1.4.109, allowing remote attackers to extract sensitive database information.

An unauthenticated stored DOM-based XSS vulnerability in the Frontend Post Submission Manager Lite plugin (<= 1.3.4) allows script injection via the post_content parameter when guest submissions are enabled.

An authenticated deserialization vulnerability in ConvertPlus <= 3.6.3 allows subscribers to inject arbitrary PHP objects via the cp_display_preview_modal AJAX action.

An improper authorization vulnerability in the Groups - Memberships and Access Control WordPress plugin allows authenticated subscribers to escalate privileges by manipulating group enrollment context.

An authentication bypass vulnerability in the miniOrange OTP Login, Verification and SMS Notifications plugin allows unauthenticated attackers to log in as administrators by abusing a flawed login intent parameter.

The Request a Quote for WooCommerce plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions 2.9.2 and below, allowing remote attackers to upload executable PHP files.

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone_number' parameter, allowing unauthenticated attackers to inject malicious scripts that execute in the context of administrator sessions.

An unauthenticated privilege escalation vulnerability (CVE-2026-93901) in the Optima Express IDX plugin allows attackers to elevate a pre-registered 'optima-express' user account to the Author role.

The AMP for WP WordPress plugin is vulnerable to stored Cross-Site Scripting via insufficient sanitization of comment content, allowing unauthenticated attackers to execute arbitrary web scripts.

An authorization bypass vulnerability in the Customer Reviews for WooCommerce plugin for WordPress allows unauthenticated attackers to delete arbitrary files from the WordPress Media Library.

An unauthenticated Stored Cross-Site Scripting vulnerability in Zero Spam for WordPress (CVE-2026-96752) allows attackers to inject malicious scripts into logs via nested POST array keys in Contact Form 7 submissions.

Themify Builder versions 7.8.1 and earlier are vulnerable to Stored Cross-Site Scripting (XSS) via the css[fonts] parameter, allowing unauthenticated attackers to inject malicious scripts due to exposed nonces.

An unauthenticated access control vulnerability in the Modula Image Gallery WordPress plugin (<= 3.0.1) allows attackers to enumerate private gallery contents and download images via insecure meta tag generation.

An unauthenticated remote code execution vulnerability (CVE-2026-19804) exists in the s2Member WordPress plugin, allowing attackers to execute code via the first_name parameter when combined with a leaked proxy verification key.

An unauthenticated stored DOM-based cross-site scripting vulnerability in the HT Contact Form plugin for WordPress allows attackers to execute arbitrary scripts via crafted draft resume URLs.

An unauthenticated stored cross-site scripting vulnerability in the Fancy Product Designer WordPress plugin allows attackers to inject malicious scripts via the output_format parameter.

The YOP Poll plugin for WordPress, in versions up to 7.0.10, exposes REST nonces via postMessage to window.opener, enabling attackers to perform unauthorized administrative actions including account takeover.

The eesy_ID2WP WordPress plugin contains a path traversal vulnerability (CVE-2026-77193) via the id2wp_path parameter, allowing unauthenticated attackers to read arbitrary files from the hosting server.

The Paytium: Mollie payment forms & donations plugin for WordPress contains an unauthenticated privilege escalation vulnerability allowing attackers to register as site administrators.

An escape character mismatch between CSV export and import functions in the Import and export users and customers WordPress plugin allows authenticated users to escalate privileges to administrator.

CVE-2026-87902 allows unauthenticated remote code execution in WordPress by enabling the loading of arbitrary files outside of legitimate theme directories.

CVE-2026-19125 allows unauthenticated attackers to bypass authentication in the EthPress WordPress plugin (v2.3.5 and below) by supplying malformed signatures to impersonate any user with a linked Ethereum wallet.

An unauthenticated-accessible Local File Inclusion vulnerability in the WP Travel Engine plugin (CVE-2026-9231) allows authenticated contributors to achieve remote code execution by including arbitrary PHP files.

The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored XSS via the 'qty' parameter, allowing unauthenticated attackers to execute arbitrary scripts in the context of administrative or user sessions.

The HUSKY Products Filter for WooCommerce Professional plugin (<= 1.4.4) is vulnerable to unauthenticated Local File Inclusion (LFI) due to inadequate nonce protection, allowing remote code execution via arbitrary PHP file inclusion.

The WP Ultimate Review plugin for WordPress contains an arbitrary shortcode execution vulnerability (CVE-2026-92235) that allows authenticated attackers with subscriber-level access to execute arbitrary shortcodes.

An incorrect authorization vulnerability in WP Table Builder versions <= 2.2.1 allows authenticated subscribers to trash or restore arbitrary posts via faulty permission checks.

An arbitrary file deletion vulnerability in the BM Content Builder plugin for WordPress allows authenticated attackers to delete critical system files, potentially facilitating remote code execution.

CVE-2026-94504 describes a stored cross-site scripting vulnerability in Ninja Forms version 3.15.3, allowing attackers to execute arbitrary scripts in an administrator's browser session via the legacy submission editor.

The TranslatePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the Translation Memory Suggestion Panel, allowing unauthenticated attackers to execute arbitrary scripts in administrator sessions.

An unauthenticated PHP object injection vulnerability in the Give - Tributes plugin (<= 2.3.1) allows attackers to inject serialized objects during the donation process, potentially leading to RCE if chained with existing application gadgets.

The CMP - Coming Soon & Maintenance Plugin is vulnerable to privilege escalation due to an unauthenticated AJAX setting import that allows authenticated editors to modify arbitrary site options.

WordPress is susceptible to multiple vulnerabilities that may allow unauthenticated attackers to achieve remote code execution, bypass security controls, perform cross-site scripting, or access sensitive data.

An adversary linked to the Red Heron group is exploiting multiple vulnerabilities in WordPress, Ubiquiti, and ZyXEL devices to conduct reconnaissance, gain persistence, and exfiltrate sensitive records, including over 18,000 government documents.

The YS LeadGen plugin for WordPress versions 2.1.4 and earlier contains an unauthenticated information exposure vulnerability allowing the retrieval of form submission data.

The ProfilePress WordPress plugin is vulnerable to arbitrary shortcode execution in versions up to 4.17.2, allowing authenticated users with subscriber-level access to execute arbitrary shortcodes.

The Welcomizer WordPress plugin contains a remote code execution vulnerability allowing authenticated subscribers to inject arbitrary PHP code via an insufficiently protected AJAX handler.

The Quill Forms WordPress plugin (<= 5.7.1) contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious JavaScript via form entry fields.

The Save as PDF Plugin for WordPress up to version 4.6.1 is vulnerable to arbitrary function invocation via the pdf_created_callback shortcode attribute, allowing authenticated Contributor-level users to trigger sensitive data disclosure.

The Forminator plugin for WordPress contains an arbitrary shortcode execution vulnerability (CVE-2026-92229) allowing unauthenticated attackers to execute arbitrary shortcodes by leveraging improper input validation.

The WP Recipe Maker plugin for WordPress (<= 10.8.1) is vulnerable to arbitrary shortcode execution due to recursive do_shortcode calls on user-supplied metadata fields.