CVE-2026-108092 - The Blog2Social – Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Insecure

CVE-2026-96537 - The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that r

CVE-2026-92429 - The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a pa

CVE-2026-92428 - The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a pa

CVE-2026-81534 - The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Executi

CVE-2026-74920 - The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input

CVE-2026-11905 - The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to

CVE-2026-109145 - The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its

CVE-2026-106031 - The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a le

CVE-2026-104643 - The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in

CVE-2026-103324 - The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify

CVE-2026-103304 - The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on

CVE-2026-88043 - The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_ty

CVE-2026-86803 - The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versi

CVE-2026-78087 - The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'lin

CVE-2026-78001 - The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerab

CVE-2026-18586 - The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthen

CVE-2026-18557 - The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Ref

CVE-2026-18548 - The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to St

CVE-2026-17031 - The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to

CVE-2026-17001 - The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Sc

CVE-2026-15180 - The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '

CVE-2026-15090 - The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'link_url' p

CVE-2026-3712 - The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up

CVE-2026-14572 - The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable t

CVE-2026-108587 - The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is

CVE-2026-86461 - The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload i

CVE-2026-97315 - The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values s

CVE-2026-88998 - The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming paym

CVE-2026-82844 - The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was comp

CVE-2026-103308 - The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of paym

CVE-2026-101301 - The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for t

CVE-2026-110284 - The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable t

CVE-2026-107757 - The Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '

CVE-2026-107756 - The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display

CVE-2026-107754 - The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPre

CVE-2026-107751 - The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_name'

CVE-2026-107650 - The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPre

CVE-2026-107631 - The Record of Consent Extension for Complianz plugin for WordPress is vulnerable to Stored Cross-Sit

CVE-2026-104909 - The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and

CVE-2026-104764 - The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all

CVE-2026-104761 - The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' p

CVE-2026-104748 - The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for Wor

CVE-2026-103380 - The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPres

CVE-2026-103367 - The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Incl

CVE-2026-103366 - The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPres

CVE-2026-100163 - The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPres

CVE-2025-9373 - The PeproDev Branches Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all v

CVE-2026-96904 - The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to vi

CVE-2026-96900 - The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownersh

CVE-2026-94360 - The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticit

CVE-2026-94261 - The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier

CVE-2026-94260 - The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, th

CVE-2026-94254 - The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when to

CVE-2026-92426 - The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the reque

CVE-2026-92409 - The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a s

CVE-2026-91076 - The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the auth

CVE-2026-90989 - The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users wit

CVE-2026-89288 - The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it

CVE-2026-88927 - The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify tha

CVE-2026-87974 - The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its p

CVE-2026-87843 - The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authent

CVE-2026-86799 - The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor esca

CVE-2026-86797 - The Pricing Table WordPress plugin before 2.1.5 does not validate the scheme of a user-supplied lin

CVE-2026-86787 - The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from sup

CVE-2026-85000 - The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an u

CVE-2026-108069 - The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted

CVE-2026-108066 - The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before r

CVE-2026-108064 - The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on o

CVE-2026-107594 - The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path take

CVE-2026-107508 - The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used

CVE-2026-107320 - The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity

CVE-2026-107319 - The GamiPress WordPress plugin before 8.0.6 does not perform a capability check or ownership verifi

CVE-2026-107178 - The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery ligh

CVE-2026-107160 - The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or i

CVE-2026-107158 - The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or v

CVE-2026-107126 - The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-control

CVE-2026-106646 - The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can

CVE-2026-106469 - The Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon markup stored in its

CVE-2026-106166 - The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or reques

CVE-2026-106099 - The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export actio

CVE-2026-106098 - The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of

CVE-2026-105975 - The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of

CVE-2026-105969 - The CodeAtoZ B2B Suite for WooCommerce WordPress plugin before 1.6.1 does not properly restrict acce

CVE-2026-105261 - The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change

CVE-2026-104751 - The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability or nonce check befo

CVE-2026-104644 - The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape

CVE-2026-103307 - The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly saniti

CVE-2026-103369 - The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Sto

CVE-2026-101926 - The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection via t

CVE-2026-101924 - The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to

CVE-2026-97471 - The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in a

CVE-2026-97398 - The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via

CVE-2026-97020 - The PO/MO Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'podata'

CVE-2026-96661 - The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gme

CVE-2026-95816 - The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to

CVE-2026-95808 - The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is v

CVE-2026-95807 - The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Sho

CVE-2026-94377 - The Verified Reviews (Avis Vérifiés) plugin for WordPress is vulnerable to Stored Cross-Site Scripti

CVE-2026-93885 - The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress is vulnerable to S

CVE-2026-87855 - The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all

CVE-2026-83592 - The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via

CVE-2026-78193 - The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via

CVE-2026-77114 - The Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dg_thumb

CVE-2026-16495 - The Countdown Timer – Widget Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scrip

CVE-2026-104800 - The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and

CVE-2026-100193 - The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected

CVE-2026-100185 - The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vu

CVE-2026-100153 - The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERY_ST

CVE-2026-97668 - The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the g

CVE-2026-97657 - The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass v

CVE-2026-110002 - The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all vers

CVE-2026-103422 - The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' par

CVE-2026-102251 - The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection v

CVE-2026-92097 - The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution i

CVE-2026-17092 - The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vu

CVE-2026-107652 - The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File D

CVE-2026-104995 - The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to,

CVE-2026-104767 - The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnera

CVE-2026-104749 - The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin f

CVE-2026-103425 - The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' p

CVE-2026-103423 - The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to

CVE-2026-89097 - The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Sensitive Informati

CVE-2026-15399 - The Animated Number Counters plugin for WordPress is vulnerable to generic SQL Injection via the 'co

CVE-2026-102562 - The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField

CVE-2026-102007 - The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin f

CVE-2026-89271 - The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination o

CVE-2026-89269 - The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and

CVE-2026-108481 - Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows

CVE-2026-108479 - Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows

CVE-2026-84167 - The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the

CVE-2026-84166 - The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrat

CVE-2026-107791 - The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate

CVE-2025-15703 - The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specificatio

CVE-2026-108981 - ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations wher

CVE-2026-97183 - The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its

CVE-2026-96227 - The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submissio

CVE-2026-94235 - The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one o

CVE-2026-93550 - The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remot

CVE-2026-91829 - The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter befor

CVE-2026-89305 - The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before

CVE-2026-89304 - The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before

CVE-2026-89302 - The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a paramete

CVE-2026-89299 - The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter b

CVE-2026-89297 - The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter

CVE-2026-89287 - The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter b

CVE-2026-89285 - The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request paramete

CVE-2026-89283 - The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or

CVE-2026-89234 - The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using

CVE-2026-89232 - The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before usi

CVE-2026-89214 - The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values be

CVE-2026-89213 - The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter befo

CVE-2026-89195 - The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a paramet

CVE-2026-88930 - The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set b

CVE-2026-88905 - The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check wh

CVE-2026-88903 - The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handler

CVE-2026-88827 - The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on a

CVE-2026-88826 - The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJA

CVE-2026-88785 - The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered m

CVE-2026-87764 - The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat me

CVE-2026-87762 - The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks

CVE-2026-87761 - The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or

CVE-2026-87760 - The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measu

CVE-2026-86798 - The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of it

CVE-2026-86717 - The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of it

CVE-2026-86706 - The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on o

CVE-2026-85126 - The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX a

CVE-2026-85121 - The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of it

CVE-2026-85118 - The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capabi

CVE-2026-84737 - The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when a

CVE-2026-84734 - The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied

CVE-2026-84261 - The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape

CVE-2026-84260 - The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape c

CVE-2026-84259 - The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content

CVE-2026-84258 - The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape con

CVE-2026-84254 - The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation a

CVE-2026-84253 - The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation an

CVE-2026-84252 - The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF

CVE-2026-84251 - The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and

CVE-2026-81649 - The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on sev

CVE-2026-81420 - The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it

CVE-2026-81156 - The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery set

CVE-2026-81155 - The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting befor

CVE-2026-81154 - The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before o

CVE-2026-81153 - The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image setti

CVE-2026-14854 - The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before

CVE-2026-12980 - The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substitut

CVE-2026-107694 - The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 do

CVE-2026-107507 - The Squadeno WordPress plugin before 1.12.0 does not enforce its restrictions on every way a sport

CVE-2026-106029 - The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity

CVE-2026-104684 - The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read

CVE-2026-104682 - The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gal

CVE-2026-104681 - The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to

CVE-2026-104680 - The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability

CVE-2026-104028 - The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce ver

CVE-2026-103695 - The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before us

CVE-2026-103694 - The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a

CVE-2026-103305 - The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when sav

CVE-2026-108695 - MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that

CVE-2026-81797 - Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2

CVE-2026-57806 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-105892 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rtCa

CVE-2026-91136 - The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and inclu

CVE-2026-4791 - The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Stored Cross-Site Scri

CVE-2026-107657 - The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnera

CVE-2026-104722 - The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vul

CVE-2026-97396 - The Email Marketing for WordPress and WooCommerce – Retainful plugin for WordPress is vulnerable to

CVE-2026-97340 - The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored

CVE-2026-96662 - The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPres

CVE-2026-96653 - The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via 'display_nam

CVE-2026-96563 - The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Store

CVE-2026-96278 - The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUES

CVE-2026-93746 - The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for W

CVE-2026-104803 - The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to,

CVE-2026-104728 - The AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin for

CVE-2026-103478 - The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored C

CVE-2026-102774 - The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DO

CVE-2026-102291 - The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable t

CVE-2026-101921 - The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

CVE-2026-101920 - The Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin for WordPres

CVE-2026-100178 - The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting

CVE-2026-100147 - The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored

CVE-2026-97348 - The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versi

CVE-2026-96840 - The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scrip

CVE-2026-96574 - The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restrictio

CVE-2026-96572 - The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Si

CVE-2026-96558 - The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to S

CVE-2026-95684 - The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Sc

CVE-2026-94538 - The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up t

CVE-2026-89100 - The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Sit

CVE-2026-6243 - The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting v

CVE-2026-5725 - The Favicon Rotator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fv

CVE-2026-3717 - The CV Builder – Professional Resume Builder SaaS plugin for WordPress is vulnerable to unauthorized

CVE-2026-15178 - The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, a

CVE-2026-12626 - The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to

CVE-2026-107742 - The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is

CVE-2026-107712 - The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Inject

CVE-2026-104801 - The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbi

CVE-2026-104006 - The SpeedyCache – Cache, Optimization, Performance plugin for WordPress is vulnerable to Sensitive I

CVE-2026-103897 - The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting

CVE-2026-103427 - The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cou

CVE-2026-102402 - The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scri

CVE-2026-100196 - The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to St

CVE-2026-100161 - The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site

CVE-2026-97643 - The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored C

CVE-2026-96682 - The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Cont

CVE-2026-96667 - The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable t

CVE-2026-94421 - The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' p

CVE-2026-94375 - The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Info

CVE-2026-94257 - The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being chang