CVE-2026-95523
— WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability
Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-95522
— WordPress Easy Digital Downloads plugin <= 3.7.0 - SQL Injection vulnerability
Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-95515
— WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-95514
— WordPress Netgsm plugin <= 2.10.0 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions.
netgsm
|
Remote
|
Authentication
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-95513
— WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.6.0 - B…
Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions.
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-94684
— WordPress Ocean Extra plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Ocean Extra <= 2.6.1 versions.
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-94682
— WordPress Podcast Importer SecondLine plugin <= 1.5.6 - Cross Site Scripting (XSS) vulner…
Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions.
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-94680
— WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-94679
— WordPress Fluent Support plugin <= 2.3.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions.
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-94671
— WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-94500
— WordPress ElementsKit Elementor addons Lite plugin <= 4.0.5 - Cross Site Scripting (XSS) …
Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions.
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-94498
— WordPress AppMySite plugin <= 3.15.4 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-94487
— WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) …
Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions.
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-94461
— WordPress Ditty plugin <= 3.1.69 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions.
ditty
|
Remote
|
Cross-Site Scripting
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-94457
— WordPress Captcha Code plugin <= 3.32 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions.
Remote
|
Authentication
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-94391
— WordPress Ultimate FAQ plugin <= 2.4.14 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions.
Remote
|
Cross-Site Scripting
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-94181
— Address Bar Spoof Risk; Missing Fullscreen Notification via Select Element
An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFullscreen without displaying the fullsc…
Remote
|
Misconfiguration
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-94179
— WordPress Razorpay Payment Button plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerabil…
Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.
Remote
|
Cross-Site Scripting
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-94176
— WordPress Mang Board WP plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions.
Remote
|
Cross-Site Scripting
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-94174
— WordPress Email Log plugin <= 2.63 - SQL Injection vulnerability
Administrator SQL Injection in Email Log <= 2.63 versions.
Remote
|
Injection
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026