Vulnerabilities

CVE-2026-81813 Elementor < 4.3.5 (Fixed in 4.3.5)

Elementor < 4.3.5 – Contributor+ Stored XSS via SVG CDATA Sanitizer Bypass

Elementor’s SVG sanitizer inspects only the elements and attributes of uploaded SVG files and ignores their text content. A user with the Contributor role or higher can upload an SVG whose CDATA conte...

Published

Medium 6.8

2026-10-19

CVE-2026-104641 Tips and Tricks HQ < 5.3.3

Simple Shopping Cart < 5.3.3 – Unauthenticated Payment Bypass via Unverified PayPal IPN Recipient

The plugin does not verify, in its default configuration, that an incoming PayPal IPN notification refers to a payment received by the site owner’s PayPal account. An unauthenticated attacker can pay...

Published

High 7.5

2026-10-19

CVE-2026-19723 UltimatelySocial < 3.0.1

Social Media Share Buttons & Social Sharing Icons — Reflected XSS via Pin It Share Handler

The plugin fails to properly escape a value from the incoming request before outputting it inside an inline JavaScript event handler, allowing Reflected XSS when a user interacts with the affected sha...

Published

High 7.1

2026-08-31

CVE-2026-84224 Kirki 6.3.2

Kirki < 6.3.2 – Editor+ Blind SSRF via Remote Template URL

The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL before fetching it. Users with Editor-level access or higher may cause the server to send requests to otherwise inaccessible...

Published

Medium

CVE-2026-77786 Rank Math < 1.0.277

Broken access control in Rank Math SEO

Discovered and responsibly disclosed a Broken Access Control vulnerability (CWE‑863, Incorrect Authorization) in Rank Math SEO — one of the most widely deployed WordPress SEO plugins, with millions of...

Published

Medium 4.9

2026-08-27

CWE-436 DataDog

GuardDog - ZIP parser differential hides a malicious payload from the scanner

A crafted wheel sets the end-of-central-directory record to report zero entries. Python's zipfile then reads the archive as empty and the scanner reports no indicators, while the installer still unpac...

Vendor fixed

High 7.4

2026-06-24

CVE-2026-84223 Themeum 6.0.0 – 6.3.0

Kirki 6.0.0 – 6.3.0 – Author+ Stored XSS via Unsanitized SVG Upload

Kirki does not sanitize uploaded SVG files while making them uploadable site-wide. This allows users with author-level access and above to upload an SVG containing JavaScript, which is then served fro...

Published

Medium 6.8

2026-09-17

CVE-2026-104643 mra13 / Team Tips and Tricks HQ All versions before 2.0.2 (< 2.0.2)

Easy HTTPS Redirection (SSL) < 2.0.2 – Subscriber+ Scan Result Disclosure and Site-Wide URL Rewrite

The Easy HTTPS Redirection (SSL) WordPress plugin versions before 2.0.2 lack capability checks in certain AJAX actions. An authenticated user with low privileges, such as a Subscriber, may disclose UR...

Published

Medium 4.2

2026-01-13

CVE-2026-74992 Themeum < 6.2.3

Stored XSS via font archive upload in Kirki

Discovered and responsibly disclosed CVE-2026-74992, an Editor+ Stored XSS vulnerability in the "Kirki" plugin. The plugin did not validate the files inside uploaded font archives (ZIP) and did not re...

Published

Medium 6.8

2026-08-18

CVE-2026-106095 Code Snippets 3.10.0

Code Snippets < 3.10.0 – Admin+ Network-Scoped Snippet Activation and Deactivation via update_code_snippet

The Code Snippets plugin for WordPress does not perform a capability check on a snippet-management action and derives the target snippet's network scope from the request rather than the stored record....

Published

Low 3.3

2026-10-07

CVE-2026-84222 Kirki 6.2.1 - 6.2.5

Kirki Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter

Kirki versions 6.2.1 through 6.2.5 do not verify whether a requester is authorized to view a post before rendering its content via the kirki_data parameter. This allows unauthenticated attackers to di...

Published

Medium 5.3

2026-09-07

CVE-2026-19719 UltimatelySocial < 3.0.1

Social Media Share Buttons & Social Sharing Icons — Contributor+ Stored XSS via Post Title

The plugin fails to escape the post title before outputting it inside an inline JavaScript event handler, allowing users with the Contributor role or above to inject Stored XSS that triggers when a vi...

Published

Medium 6.8

2026-08-31

CVE-2026-84743 The Events Calendar / StellarWP 6.15.16.1 – 6.17.4.1

The Events Calendar 6.15.16.1 – 6.17.4.1 – Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes

The Events Calendar fails to perform proper per-object authorization checks on a family of REST API write routes. An authenticated user with a low-privilege role such as Contributor can modify, unpubl...

Published

Low 3.8

2026-09-21

CVE-2026-84745 StellarWP (The Events Calendar) < 6.17.3.1

The Events Calendar — Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST API

The plugin fails to restrict access to non-public content on its public REST API archives, allowing users with the Contributor role or above to read the full contents of every unpublished event, venue...

Published

Low 2.7

2026-09-03

CVE-2026-77787 Rank Math < 1.0.277

Rank Math SEO - Author+ Term Metadata Update and Cross-Object Post Title Overwrite via updateMetaBulk

The plugin does not perform a capability check when processing bulk metadata updates targeting taxonomy terms, and reuses the supplied object identifier across different object types. This allows user...

Published

Low 2.7

2026-08-31

CVE-2026-77785 Rank Math < 1.0.277

Rank Math SEO - Author+ Non-Public Post Content Disclosure via Abilities API

The plugin does not verify that the requesting user is authorized to access the specific post referenced in a request before returning it via the Abilities API, allowing users with the Author role or...

Published

Low 2.7

2026-08-31

CVE-2026-19615 WPease < 9.0.1

Stored XSS via unsanitised SVG upload in Admin and Site Enhancements

Discovered and responsibly disclosed CVE-2026-19615, an Author+ Stored XSS vulnerability in the "Admin and Site Enhancements (ASE)" plugin. The plugin failed to sanitize uploaded SVG files across all...

Published

Medium 6.8

2026-08-18

— Plugins360 Labs < 2.9.0

Multiple vulnerabilities in Automatic YouTube Gallery

Discovered and responsibly reported multiple security vulnerabilities in the WordPress plugin "Automatic YouTube Gallery" developed by Plugins360 Labs. The reported issues included: • Unauthenticate...

Vendor fixed

High 7.4

2026-08-10

CWE-778 CrowdSec

CrowdSec — Exim parser silently skips authentication failures

The grok pattern required a set_id capture group that authentication-failure lines never contain, so brute-force attempts against Exim produced no events at all. Fixed by making the group optional, wh...

Vendor fixed

Low

2026-06-24

CVE-2026-19075 PluginsWare < 4.9.2

SSRF in All-in-One Video Gallery

Discovered and responsibly disclosed CVE-2026-19075, a Server-Side Request Forgery (SSRF) vulnerability affecting the All-in-One Video Gallery WordPress plugin versions < 4.9.2. The vulnerability aff...

Published

Medium 5.0

2026-08-07

CWE-295 Meow Apps < 3.6.5

Improper TLS certificate verification in AI Engine

Discovered and responsibly disclosed a security vulnerability in the AI Engine WordPress plugin, which has 100,000+ active installations. The vulnerability was validated and fixed by the developer in...

Vendor fixed

Medium

2026-07-28

CWE-295 keywordrush

Content Egg — certificate validation skipped on affiliate feeds

The same weakness class as the AI Engine finding, in a second plugin: outbound requests to affiliate data feeds do not verify the server certificate. Held back from publication until the vendor ships...

Vendor fixed

Medium