CVE-2026-14821
— Quiz And Survey Master < 11.1.5 - Contributor+ Arbitrary Template Deletion
The Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete…
|
Authorization
Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
CVE-2026-14819
— Event Tickets < 5.28.4 - Editor+ Stored XSS via Ticket Move
The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above t…
|
Cross-Site Scripting
Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
CVE-2026-14545
— TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Re…
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to…
|
Authentication
Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
CVE-2026-14490
— Demi <= 0.0.6 - Unauthenticated Arbitrary Directory Deletion via demi_restore_step AJAX a…
The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists b…
Remote
|
Path Traversal
Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
CVE-2026-12124
— PDFDraft <= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via…
The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability …
Remote
|
Authorization
Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting (XSS) via the <select> element. An attacker can supply a malicious payload that is rendered directly into the …
Remote
|
Cross-Site Scripting
Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks …
Remote
|
Path Traversal
Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
CVE-2026-66473
— WordPress Xendit Payment plugin <= 7.1.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Xendit Payment <= 7.1.0 versions.
Remote
|
Authorization
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65448
— WordPress Anti Spam and list cleaner – AcyChecker plugin <= 1.8.1 - Cross Site Scripting …
Unauthenticated Cross Site Scripting (XSS) in Anti Spam and list cleaner – AcyChecker <= 1.8.1 versions.
Remote
|
Cross-Site Scripting
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65447
— WordPress Contest Gallery plugin <= 30.0.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions.
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65446
— WordPress Kali Forms plugin <= 2.4.18 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions.
Remote
|
Cross-Site Scripting
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65445
— WordPress Ad Invalid Click Protector (AICP) plugin <= 1.3.0 - Broken Access Control vulne…
Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versions.
Remote
|
Authorization
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65443
— WordPress BackWPup plugin <= 5.7.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions.
Remote
|
Cross-Site Scripting
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65442
— WordPress FormCraft plugin <= 3.9.15 - Server Side Request Forgery (SSRF) vulnerability
Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versions.
Remote
|
Server-Side Request Forgery
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65441
— WordPress GiveWP plugin <= 4.16.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions.
Remote
|
Cross-Site Scripting
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65440
— WordPress GetGenie plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions.
Remote
|
Cross-Site Scripting
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65439
— WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS)…
Unauthenticated Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <=3.5.45 versions.
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65438
— WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.9 - Cross Site Scripting (XSS…
Unauthenticated Cross Site Scripting (XSS) in Message Filter for Contact Form 7 <= 1.6.3.9 versions.
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-65437
— WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin <= 6.82 - Cross Site Sc…
Unauthenticated Cross Site Scripting (XSS) in Spam protection, AntiSpam, FireWall by CleanTalk <= 6.82 versions.
Remote
|
Cross-Site Scripting
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
CVE-2026-61957
— WordPress miniorange otp verification plugin <= 5.5.1 - Cross Site Scripting (XSS) vulner…
Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5.1 versions.
Remote
|
Cross-Site Scripting
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
Jul 27, 2026
