Security releases
Researcher credits in vendor advisories
Vendors name researchers in their own advisories. Find your line and claim it. It counts on your profile right away and gets a BugRater ID you can quote.
Vendor
-
Cbutlerjr CVE-2026-96565
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Checkout Multicheckbox/Multiselect Field (sca
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Happyforms CVE-2026-93766
The Happyforms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'happyforms_client_referer' parameter in all versions up to, and in
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Happyforms CVE-2026-93755
The Happyforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via spoofable client IP headers in versions up to, and including, 1.38.9. This
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
E4jvikwp CVE-2026-93429
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'guests[][][documents]' Parameter in all version
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Andy_moyle CVE-2026-123418
The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lat' parameter in all versions up to, and including, 5.1.7 due to in
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Westguard CVE-2026-122231
The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field_<id>[0][0]' parameter in al
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Mpol CVE-2026-122059
The WP ImageViewer plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'img.alt' parameter in all versions up to, and including,
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Jetmonsters CVE-2026-121977
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note (form field whose value is writ
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Wpchill CVE-2026-121976
The Modula plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'items' parameter in versions up to, and including, 3.0.17 This is due to i
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Cozmoslabs CVE-2026-121765
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allo
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Shapedplugin CVE-2026-120685
The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Shapedplugin CVE-2026-120683
The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Shapedplugin CVE-2026-120509
The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
RelyWP CVE-2026-119498
Authentication Bypass Using an Alternate Path or Channel vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Authentication A
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Jetmonsters CVE-2026-119183
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<form field mapped to a post meta ke
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Themegrill CVE-2026-119075
The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in the FormHandler::validate_
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Peterschulznl CVE-2026-118267
The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Latepoint CVE-2026-118066
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Account Takeove
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Oxilab CVE-2026-118056
The Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Antoineh CVE-2026-118050
The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shouttext' parameter in all versions up to, and including, 2.13.5 d
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Sbouey CVE-2026-118047
The Falang multilanguage for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'falang_term[<taxonomy>][<locale>][<field>] (vi
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Amelia CVE-2026-116751
The Booking for Appointments and Events Calendar – Amelia Pro plugin for WordPress is vulnerable to time-based SQL Injection via the 'tag[] (array KEYS)' parame
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Jackdewey CVE-2026-116537
The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link_description' parameter in all versions up to, and including, 7.
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Quttera CVE-2026-115548
The Quttera ThreatSign – Web Malware Scanner for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_USER_AGENT' parameter
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Osamaesh CVE-2026-111370
The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'os (also browser, res)' parameter in al
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Jetmonsters CVE-2026-111317
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<any form field name — e.g. 'payload
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Teamfunnelkit CVE-2026-109991
The FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Osamaesh CVE-2026-109230
The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'browser' parameter in all versions up t
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Wedevs CVE-2026-109214
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vuln
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Rubengc CVE-2026-104768
The AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin for WordPress is vulnerable to Privilege Escalation in all vers
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Wedevs CVE-2026-104760
The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'modalPlaceh
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Stylemix CVE-2026-104746
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Naimurrahmannahid CVE-2026-104014
The Naimur Email OTP Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.0. This is d
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Wpvibes CVE-2026-103914
The Dynific Addons for Elementor plugin for WordPress is vulnerable to SQL Injection via the 'q' parameter in versions up to, and including, 1.3. This is due to
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Wpvibes CVE-2026-102564
The The Dynific Addons for Elementor (formerly Anywhere Elementor) plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, an
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Totolink CVE-2026-123961
A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.884. This impacts the function setWiFiBasicConfig of the file /cgi-bin/cstecgi.cgi. The ma
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
HivePress CVE-2026-123470
Missing Authorization vulnerability in HivePress HivePress hivepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
StylemixThemes CVE-2026-123468
Missing Authorization vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Exploiting Incorrectly Configured Access Control S
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
TMS CVE-2026-123148
Missing Authorization vulnerability in TMS IvyForms ivyforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IvyForms
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Passionate Programmer Peter CVE-2026-121783
Cross-Site Request Forgery (CSRF) vulnerability in Passionate Programmer Peter WP Data Access wp-data-access allows Cross Site Request Forgery.This issue affect
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
WebberZone CVE-2026-121724
Missing Authorization vulnerability in WebberZone Contextual Related Posts contextual-related-posts allows Exploiting Incorrectly Configured Access Control Secu
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
WP Desk CVE-2026-121571
Missing Authorization vulnerability in WP Desk Autopay dla WooCommerce pay-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
VideoWhisper.com CVE-2026-120857
Missing Authorization vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Exploiting Incorrectly Configured Access Co
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Everest Forms CVE-2026-120837
Missing Authorization vulnerability in Everest Forms Everest Forms everest-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This is
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Aguila Technologies CVE-2026-120365
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area customer-area allows
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Untapwp CVE-2026-120364
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Untapwp Vidplex vidplex allows Stored XSS.This issue affec
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
WP Desk CVE-2026-119525
Missing Authorization vulnerability in WP Desk Dropshipping XML for WooCommerce dropshipping-xml-for-woocommerce allows Exploiting Incorrectly Configured Access
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Cozmoslabs CVE-2026-119523
Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Se
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Ahmad CVE-2026-119513
Missing Authorization vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Mamunur Rashid CVE-2026-119508
Missing Authorization vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services radius-booking allows Exploiting Incorre
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
BdThemes CVE-2026-119501
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pa
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
David Lingren CVE-2026-119496
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in David Lingren Media LIbrary Assistant media-library-assistant all
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Metaphor Creations, LLC CVE-2026-119492
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Metaphor Creations, LLC Ditty ditty-news-ticker allows Code Injec
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Made with Fuel Ltd. CVE-2026-119490
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Made with Fuel Ltd. Better Notifications for WP bnfw allows Code
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
StylemixThemes CVE-2026-119478
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-managemen
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Tomdever CVE-2026-95870
The wpForo Forum plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to, and including, 3.2.1 due to insuffi
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
WC Lovers CVE-2026-61990
Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Leve
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Totolink CVE-2026-123960
A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. This affects the function setWanConfig of the file /cgi-bin/cstecgi.cgi. Executing a manipulation
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Totolink CVE-2026-123959
A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.884. The impacted element is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. Perfor
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Liquid Web / StellarWP CVE-2026-123469
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar al
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
LeapWorx CVE-2026-123466
Missing Authorization vulnerability in LeapWorx Premium Blocks – Gutenberg Blocks for WordPress premium-blocks-for-gutenberg allows Exploiting Incorrectly Confi
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Liquid Web / StellarWP CVE-2026-123464
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-cale
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
myCred CVE-2026-122668
Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: f
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Blubrry Podcasting CVE-2026-121766
Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Exploiting Incorrectly Configured Access Control Security Leve
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Blubrry Podcasting CVE-2026-121762
Cross-Site Request Forgery (CSRF) vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Cross Site Request Forgery.This issue affects Powe
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Brainstorm Force CVE-2026-120853
Missing Authorization vulnerability in Brainstorm Force CartFlows cartflows allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Brainstorm Force CVE-2026-120852
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force CartFlows cartflows allows Code Injection.This i
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Elementor CVE-2026-120850
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Store
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Wpmet CVE-2026-120847
Missing Authorization vulnerability in Wpmet Metform metform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Metform:
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Brainstorm Force CVE-2026-120842
Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
ThemeGrill CVE-2026-120840
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.Th
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Icopydoc CVE-2026-120548
The YML for Yandex Market plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.10.0 via the 'y4ym_check_
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Tomdever CVE-2026-120532
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post[body]' parameter in all versions up to, and including, 3.2.2 du
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Dylanjkotze CVE-2026-120514
The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'zpm_profile_picture' parameter in all versions up to, and
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Brainstorm Force CVE-2026-119520
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg all
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Saeed CVE-2026-119511
Missing Authorization vulnerability in Saeed MC Woocommerce Wishlist smart-wishlist-for-more-convert allows Exploiting Incorrectly Configured Access Control Sec
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
WPDeveloper CVE-2026-119507
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPDeveloper NotificationX notificationx allows Code Injection.Thi
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
BdThemes CVE-2026-119502
Missing Authorization vulnerability in BdThemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Exploiting Incorrectly Configured Access Control S
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
bPlugins CVE-2026-119500
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash & HTML5 Video html5-video-player allows Sto
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Gemini Labs CVE-2026-119494
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Gemini Labs Site Reviews site-reviews allows Code Injection.This
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Metaphor Creations, LLC CVE-2026-119493
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metaphor Creations, LLC Ditty ditty-news-ticker allows Sto
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
David Lingren CVE-2026-119491
Missing Authorization vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Exploiting Incorrectly Configured Access Control Sec
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
WP ManageNinja LLC CVE-2026-119486
Missing Authorization vulnerability in WP ManageNinja LLC FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.Thi
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Supsystic CVE-2026-119484
Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Photo Gallery by Supsystic gallery-by-supsystic allows Cross Site Request Forgery.This issue affect
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Properfraction CVE-2026-119473
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in properfraction ProfilePress wp-user-avatar allows Code Injection.
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
WPVibes CVE-2026-119465
Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Retrieve Em
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Tomdever CVE-2026-119164
The wpForo Forum plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.2 via the `data[secondary_groupids]` param
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Tomdever CVE-2026-119155
The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'href[locale]' parameter in all versions up to, and including, 3.2.2 due
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
John-dagelmore CVE-2026-118784
The WPSpeed plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.10 This is due to a combination of two issue
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Tomdever CVE-2026-110004
The wpForo Forum plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the theme_delete function in all vers
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Melograno CVE-2026-107616
The Amelia plugin for WordPress is vulnerable to unauthorized access of attendee data due to a missing authorization check on the GetEventAttendeesCommandHandle
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Melograno CVE-2026-104992
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.9.1
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Denishua CVE-2026-103900
The WPJAM Basic plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 7.1 This is due to the WPJAM_User_Signup::signup()
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Suplugins CVE-2026-66669
Cross-Site Request Forgery (CSRF) vulnerability in Suplugins Superb Addons: Blocks, Patterns & Theme Designer superb-blocks allows Cross Site Request Forger
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
ThimPress CVE-2026-52713
Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Properfraction CVE-2026-39733
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in properfraction ProfilePress wp-user-avatar allows Code Injection.
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
myCred CVE-2026-124274
Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: f
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Totolink CVE-2026-123958
A vulnerability was identified in TOTOLINK CA300-PoE 6.2c.884. The affected element is the function setLanConfig of the file /cgi-bin/cstecgi.cgi. Such manipula
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Totolink CVE-2026-123957
A vulnerability was determined in TOTOLINK CA300-PoE 6.2c.884. Impacted is the function setIpQosRules of the file /cgi-bin/cstecgi.cgi. This manipulation of the
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Wpmet CVE-2026-122675
Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Social wp-social allows Cross Site Request Forgery.This issue affects Wp Social: from n/a through 3.
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit