2026

The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privil

An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileac

The Shortcodify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'name' Shortcode Attribute in all

The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.

Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in THEWP Digital Solu

ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in Restore Settings.

ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI. If this vu

ELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting vulnerability in WebUI. I

The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to SQL

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injec

An unauthenticated remote attacker can abuse the improper validation of the post-login redirect of the web-UI to trick

Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted in

A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of th

A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level inclu

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection vi

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code'

Successful exploitation of this vulnerability could allow an attacker with local network access to bypass the applicatio

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnera

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnera

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnera

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnera

The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via t

A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3

In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM (CRYSTALS-Kyber) routines divided secret-derived polyno

The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and i

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to time-bas

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure

The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbi

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory C

The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the

The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and e

The Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does not perform a capability check before deleting out

The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputtin

The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password throu

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory D

The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for Word

Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting (XSS) via the <select> element.

Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path va

Unauthenticated Broken Access Control in Xendit Payment <= 7.1.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Anti Spam and list cleaner &#8211; AcyChecker <= 1.8.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions.

Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions.

Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versions.

Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions.

Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versions.