CVEs
Vulnerability entries credited to me. Click a card to read the full description.
77 CVEs1 Critical16 High44 Medium16 Low
2026
-
CVE-2026-115183 LOW 2.4 Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget WordPress pluginQi Addons For Elementor
The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts where WordPress would otherwise strip them.
-
CVE-2026-111980 MEDIUM 5.5 GiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability Grant WordPress pluginGiveWP
The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, allowing users with a custom fundraising role to edit, publish and read pages owned by other users, including administrators.
-
CVE-2026-111979 MEDIUM 6.8 GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color WordPress pluginGiveWP
The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute, allowing users with a custom form-editing GiveWP WordPress plugin before 4.19.0.1 role to inject arbitrary web scripts that execute in the browser of any visitor or administrator who opens the affected donation form.
-
CVE-2026-111978 MEDIUM 6 GiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings Import WordPress pluginGiveWP
The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk, allowing users with a high-privilege custom role to perform path traversal, disclose the contents of JSON-parseable files anywhere on the server, and overwrite the GiveWP WordPress plugin before 4.19.0.1's stored configuration.
-
CVE-2026-113673 HIGH 7.2 GeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export WordPress pluginGeoDirectory
The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger.
-
CVE-2026-113490 MEDIUM 5.3 GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint WordPress pluginGeoDirectory
The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink and card fields of non-public (draft, pending, private and trashed) listings by supplying the listing ID.
-
CVE-2026-113489 MEDIUM 4.3 GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR WordPress pluginGeoDirectory
The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image.
-
CVE-2026-112207 HIGH 7.1 Download Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download Link WordPress pluginDownload Monitor
The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.
-
CVE-2026-94263 MEDIUM 4.8 Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success Message WordPress pluginAdvanced Custom Fields: Extended
The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.
-
CVE-2026-94264 MEDIUM 6.8 Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode Attributes WordPress pluginAdvanced Custom Fields: Extended
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output without escaping, allowing users with a role as low as contributor to have arbitrary script run in the browser of anyone led to open a crafted link or page, including a logged-in administrator. This is an incomplete fix for CVE-2023-5292, whose deny-list covers only the three HTML wrapper attributes.
-
CVE-2026-94262 HIGH 8.1 Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover via Front-End User Update Action WordPress pluginAdvanced Custom Fields: Extended
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the target account holds an administrator role, which allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires the site to publish a form whose user-update action maps its target to a visitor-submitted value rather than to the default current user.
-
CVE-2026-113501 LOW 3.1 LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal WordPress pluginLiteSpeed Cache
The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the specific notice being dismissed, so on sites in certain configurations a low-privileged authenticated user (Subscriber) can dismiss administrative notices the LiteSpeed Cache WordPress plugin before 7.9.2 marks as non-dismissible, including a warning that sensitive files may be publicly accessible.
-
CVE-2026-113472 MEDIUM 5.4 Depicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media Upload WordPress pluginDepicter — Popup & Slider Builder
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint, checking only the client-supplied MIME type and a case-sensitive block of the .php extension, which allows users with the Editor role and above to upload files with other active extensions into the public uploads directory, leading to stored script execution in the site origin and, depending on the server's handler mapping, to code execution.
-
CVE-2026-112219 MEDIUM 4.9 Download Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved Download Paths REST Route WordPress pluginDownload Monitor
The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite, allowing a subsite administrator who is not trusted at the network level to approve arbitrary locations and have the Download Monitor WordPress plugin before 5.3.5 serve readable files from outside the uploads directory, including files belonging to other subsites, to unauthenticated visitors; single-site installations are unaffected.
-
CVE-2026-111738 MEDIUM 5.5 Speed Optimizer < 7.8.5 - Admin+ Network Option Update via enable-option/disable-option WordPress pluginSpeed Optimizer
The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level privilege before applying an option change to the whole multisite network, nor restrict which option may be changed, allowing a site administrator who is not a Super Admin to create or overwrite network-wide options.
-
CVE-2026-111737 LOW 3.5 Speed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists WordPress pluginSpeed Optimizer
The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of front-end pages, which could allow high-privilege users such as admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).
-
CVE-2026-110510 LOW 3.5 Essential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and Post Timeline Title Tag WordPress pluginEssential Addons for Elementor
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could allow users with the author role and above to inject iframe and form elements into published pages.
-
CVE-2026-109935 MEDIUM 5.3 Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST API WordPress pluginOtter Blocks
The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing unauthenticated users to read block content that the site owner restricted to specific roles, logged-in users, the post author, categories or tags, or (on the Pro tier) Stripe purchasers.
-
CVE-2026-109933 MEDIUM 6.8 Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes WordPress pluginOtter Blocks
The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including administrators, views the affected post.
-
CVE-2026-78392 MEDIUM 6.8 Link Library < 7.9.6 - Contributor+ Stored XSS via 'link_target' Parameter WordPress pluginLink Library
The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an attribute of a link preview, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. The preview is generated without authentication and without checking whether the link has been published, so an unapproved submission is enough to reach any visitor who opens it.
-
CVE-2026-79627 HIGH 7.1 Advanced File Manager 5.4.13 - 5.4.14 - Authenticated Stored XSS via SVG Sanitiser Content-Sniff Bypass WordPress pluginAdvanced File Manager
The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone who opens it, including an administrator.
-
CVE-2026-105257 LOW 2.7 LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR WordPress pluginAppointment Booking Plugin
The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate the personal information of every customer on the site, including those managed by other agents.
-
CVE-2026-111041 MEDIUM 4.9 AI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via update_media_metadata and approve_media WordPress pluginAI Engine
The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object, allowing users with the Editor role or above to modify, or change the type of, arbitrary posts on the site, including content they are not permitted to edit.
-
CVE-2026-110981 HIGH 7.1 WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter WordPress pluginWP Photo Album Plus
The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.
-
CVE-2026-110976 MEDIUM 4.9 AI Engine < 3.7.9 - Editor+ Arbitrary Post Deletion via reject_media WordPress pluginAI Engine
The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor role and above to delete arbitrary posts of any type, including content they cannot otherwise delete such as navigation menus, block templates and global styles.
-
CVE-2026-81344 MEDIUM 6.6 Frontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object Injection WordPress pluginACF Frontend Admin by DynamiApps
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given a suitable POP chain in another installed ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 or in WordPress core, can be leveraged to achieve remote code execution.
-
CVE-2026-81343 MEDIUM 5.3 Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated ACF Options Page Field Update via Form Submission WordPress pluginACF Frontend Admin by DynamiApps
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitted values into the site's global ACF options store, allowing unauthenticated visitors to overwrite site-wide option values via a public form.
-
CVE-2026-85345 MEDIUM 4.1 FV Player 7.5.44.7212 - 7.5.54.7212 - Contributor+ SSRF via retrieve_video_data WordPress pluginFV Flowplayer Video Player
The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an existing host-based restriction fails to cover all cases, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks. The impact is limited to a semi-blind oracle: the server's fetch reveals whether an internal resource responds and its HTTP status, but the resource's contents are not returned to the attacker.
-
CVE-2026-107694 LOW 2.7 Dokan < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure via Commission REST Endpoint WordPress pluginDokan: AI Powered WooCommerce Multivendor Marketplace Solution
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that the vendor a commission calculation is requested for is the requesting vendor, allowing vendors to disclose the commission rate and fixed fee the marketplace administrator configured for other vendors.
-
CVE-2026-104682 LOW 2.7 Envira Gallery < 1.16.2 - Contributor Missing Authorization via Convert Gallery REST Route WordPress pluginEnvira Gallery
The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that the requester can edit an arbitrary post they name rather than that they are allowed to create the Envira Gallery WordPress plugin before 1.16.2's own gallery content, allowing users with contributor-level access to create and publish gallery posts that the Envira Gallery WordPress plugin before 1.16.2's settings otherwise withhold from them.
-
CVE-2026-104681 LOW 2.7 Envira Gallery < 1.16.2 - Author+ Non-Public Post Title and Excerpt Disclosure via Gallery REST Field WordPress pluginEnvira Gallery
The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to view, allowing any user able to create and edit a gallery (Author and above by default) to disclose the title and excerpt of other users' private, draft, pending and trashed posts that WordPress would otherwise withhold from them.
-
CVE-2026-104680 HIGH 7.2 Envira Gallery < 1.16.2 - Multisite Subsite Admin+ Arbitrary Plugin Installation via Onboarding Wizard WordPress pluginEnvira Gallery
The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves for installing Envira Gallery WordPress plugin before 1.16.2 code before processing its setup-wizard Envira Gallery WordPress plugin before 1.16.2-installation request, and does not restrict the installation to its own curated list, allowing a Multisite subsite Administrator to install an arbitrary WordPress.org-published Envira Gallery WordPress plugin before 1.16.2 into the network-shared Envira Gallery WordPress plugin before 1.16.2 directory, a privilege Multisite reserves for the network Super Admin.
-
CVE-2026-107321 MEDIUM 5.4 W3 Total Cache < 2.10.6 - Author+ Path Traversal via CDN Media Library Import WordPress pluginW3 Total Cache
The W3 Total Cache WordPress plugin before 2.10.6 does not confine a media-import file copy to the document root, nor enforce an effective file-type restriction on it, allowing users with the Author role or higher to plant content that, once an administrator runs the import, copies an arbitrary server-readable file into a publicly served directory, exposing it to unauthenticated retrieval.
-
CVE-2026-104754 LOW 3.5 Rank Math SEO < 1.0.280 - Admin+ Stored XSS via Redirection Source URL WordPress pluginRank Math SEO
The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting it in an administrative list view, allowing users who can manage redirections (Administrators by default) to store JavaScript that executes in the session of any user who later opens that view, including a Super Administrator on multisite.
-
CVE-2026-104753 MEDIUM 4.1 Rank Math SEO < 1.0.280 - Admin+ SQLi via 'per_page' Parameter WordPress pluginRank Math SEO
The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing high-privilege users such as administrators to perform SQL injection attacks.
-
CVE-2026-104752 HIGH 7.2 Rank Math SEO < 1.0.280 - Admin+ Arbitrary File Upload to RCE via Settings Import WordPress pluginRank Math SEO
The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution.
-
CVE-2026-84220 MEDIUM 4.8 Kirki < 6.3.2 - Unauthenticated Arbitrary Shortcode Execution via Comments Collection WordPress pluginKirki
The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders them, and displays comments regardless of their moderation status, allowing unauthenticated visitors to run shortcodes registered on the site and to read private custom fields of the page being viewed.
-
CVE-2026-104646 MEDIUM 6.8 Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Stored XSS via Gallery Shortcode Attributes WordPress pluginImage Photo Gallery Final Tiles Grid
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of anyone viewing the post, including an administrator previewing a pending submission. No gallery ownership is required: any gallery that already exists on the site can be referenced.
-
CVE-2026-96530 MEDIUM 6.5 Optimole 4.0.0 - 4.2.14 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget WordPress pluginOptimole
The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials.
-
CVE-2026-104653 MEDIUM 6.8 Envira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Crop Dimensions WordPress pluginEnvira Gallery
The Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape user-supplied gallery display configuration values before storing them and outputting them in an image tag attribute, allowing users with the Author role and above to inject arbitrary web scripts that execute when any visitor, including an administrator, views a page containing the affected gallery.
-
CVE-2026-91072 MEDIUM 4.4 EWWW Image Optimizer < 8.8.0 - Admin+ WebP File Rename and Deletion via Unrestricted Path in WebP Migration Handler WordPress pluginEWWW Image Optimizer
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on a multisite network, files belonging to a different site they have no access to.
-
CVE-2026-89003 MEDIUM 4.1 WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Preview WordPress pluginWPeMatico RSS Feed Fetcher
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the response, allowing users with contributor-level access and above to force the server to issue requests to internal-only hosts and read the responses back.
-
CVE-2026-89001 MEDIUM 4.9 WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Post Publication and Author Spoofing via Campaign Settings WordPress pluginWPeMatico RSS Feed Fetcher
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is permitted to publish content or to attribute posts to another account, allowing users with contributor-level access and above to publish posts live and set any registered user, including an administrator, as the post author.
-
CVE-2026-78394 MEDIUM 4.1 Link Library < 7.9.6 - Contributor+ Path Traversal via 'filepath' Parameter WordPress pluginLink Library
The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk, allowing users with the Contributor role and above to create directories and write or overwrite image files anywhere the web server can write, including outside the site's document root. The written file name is always numeric with a fixed image extension, so executable code cannot be planted this way.
-
CVE-2026-78393 MEDIUM 6.1 Link Library < 7.9.6 - Reflected XSS via 'link_tags' and 'link_price' Sort and Breadcrumb Links WordPress pluginLink Library
The Link Library WordPress plugin before 7.9.6 does not properly escape some parameters before outputting them in the addresses of links it generates on its front-end directory pages, leading to Reflected Cross-Site Scripting which could be used against any visitor, including logged-in administrators.
-
CVE-2026-93662 MEDIUM 4.3 Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter WordPress pluginEvents Manager
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street addresses.
-
CVE-2026-89004 LOW 2.7 WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Campaign Configuration and Log Disclosure via IDOR WordPress pluginWPeMatico RSS Feed Fetcher
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ownership or authorization before returning a campaign's stored configuration and run log, allowing users with contributor-level access and above to read the configuration and execution logs of campaigns created by other users, including administrators.
-
CVE-2026-89002 MEDIUM 6.8 WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Campaign Item Preview WordPress pluginWPeMatico RSS Feed Fetcher
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize and escape content it retrieves from a user-supplied source before rendering it, which could allow users such as contributors to perform Stored Cross-Site Scripting attacks against higher-privileged users who review the campaign.
-
CVE-2026-88843 HIGH 7.2 MasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget WordPress pluginMasterStudy LMS WordPress Plugin
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path was corrected in an earlier release and this one was not, so the issue persists in versions the earlier advisory reports as fixed.
-
CVE-2026-82849 MEDIUM 4.3 Masteriyo LMS < 3.4.2 - Subscriber+ Arbitrary User Course Progress Disclosure via IDOR WordPress pluginMasteriyo LMS
The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticated user, such as a self-registered subscriber, to read another user's learning activity. The ownership check it applies is skipped whenever the requested account is not named with a non-zero value, in which case the records of every learner on the site are returned at once.
-
CVE-2026-87069 LOW 3.1 Forminator Forms < 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate_stripe WordPress pluginForminator Forms
The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, and that construction happens on every wp-admin request for any logged-in user. Any authenticated user, including a Subscriber with no permissions in the Forminator Forms WordPress plugin before 1.57.2.1, can therefore rewrite the saved field configuration of any form on the site, including a live payment form.
-
CVE-2026-91827 HIGH 7.5 Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export WordPress pluginNinja Forms
The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another installed plugin or theme, this can lead to actions such as arbitrary file operations or remote code execution.
-
CVE-2026-87068 MEDIUM 6.6 Forminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import WordPress pluginForminator Forms
The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrator, to anyone who submits it. The same user is refused an identical form through both the ordinary form editor and the ordinary form import.
-
CVE-2026-87067 HIGH 8.5 Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection WordPress pluginForminator Forms
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permission belongs to an administrator by default, and to any role the site has granted it through the Forminator Forms WordPress plugin before 1.57.2.1's own settings, so the issue is reachable well below administrator on sites that use that feature.
-
CVE-2026-82842 HIGH 8.1 SAML Single Sign On < 6.0.0 - Unauthenticated Privilege Escalation via Account Matching WordPress pluginSAML Single Sign On
The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site's identity provider assert a login name of their choosing to authenticate as any account, including an administrator, without proving ownership of that account.
-
CVE-2026-85680 HIGH 8.8 Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title WordPress pluginUltimate Member
The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to store JavaScript that will execute when any visitor, including an administrator, views their profile.
-
CVE-2026-88844 LOW 2.7 MasterStudy LMS 3.6.2 - < 3.7.50 - Instructor+ Student PII Disclosure via IDOR WordPress pluginMasterStudy LMS WordPress Plugin
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names and email addresses of students enrolled in other instructors' courses.
-
CVE-2026-86824 MEDIUM 4.8 Newsletter < 9.3.8 - Unauthenticated Subscriber PII Disclosure and Modification via Predictable Tracking Signature Key WordPress pluginNewsletter
The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hash, allowing an unauthenticated attacker who recovers that key offline to forge tracking links, obtain any subscriber's session token, and read and modify that subscriber's stored personal data.
-
CVE-2026-85130 HIGH 8.8 WPLP Cookie Consent < 4.4.4 - Unauthenticated Stored XSS via Consent Logs WordPress pluginWPLP Cookie Consent
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for the JavaScript context it is later output in on an administrative screen, allowing unauthenticated users to run arbitrary JavaScript in the session of an administrator who interacts with the logged entry. Only multisite installations are affected.
-
CVE-2026-87860 MEDIUM 4.3 Subscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRF WordPress pluginSubscriptions for WooCommerce
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making.
-
CVE-2026-87854 MEDIUM 5.3 Subscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass WordPress pluginSubscriptions for WooCommerce
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and payment dates.
-
CVE-2026-86445 MEDIUM 5.3 LearnPress < 4.4.7 - Unauthenticated Question Bank Disclosure via load_content_via_ajax WordPress pluginLearnPress
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowing unauthenticated attackers to retrieve the text, identifier and type of every published quiz question on the site, along with a keyword search over them, which is content the LearnPress WordPress plugin before 4.4.7 otherwise keeps non-public.
-
CVE-2026-86444 HIGH 7.1 LearnPress < 4.4.7 - Reflected XSS via 'skin' Parameter WordPress pluginLearnPress
The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only sites running a classic, non-block are affected.
-
CVE-2026-85641 MEDIUM 4.3 Formidable Forms 6.34 - Unauthenticated Stored Content Injection via 'updated_by' Parameter WordPress pluginFormidable Forms
The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in the admin entry view that would otherwise be removed, and to attribute their submission to an administrator who never made it.
-
CVE-2026-85131 MEDIUM 6.5 WPLP Cookie Consent < 4.4.4 - Arbitrary Post Deletion via CSRF WordPress pluginWPLP Cookie Consent
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items to its own records, allowing attackers to make a logged in admin permanently delete arbitrary posts and pages via a crafted request.
-
CVE-2026-84907 LOW 3.7 Eventin < 4.1.24 - Unauthenticated Order and Attendee Status Reset via Payment REST Endpoint WordPress pluginEventin
The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline (local) payment method is enabled, relying on a nonce that is exposed to unauthenticated visitors and never checking that the caller owns the order, allowing unauthenticated attackers to reset any existing order and its attendees to a pending state and thereby invalidate paid tickets.
-
CVE-2026-84905 LOW 2.7 Eventin < 4.1.24 - Contributor+ User Creation via Speaker Creation WordPress pluginEventin
The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level access and above to create new WordPress user accounts that carry capabilities beyond their own, including publishing content and uploading files, and, by supplying an email address they control, to obtain a working login to the created account.
-
CVE-2026-86407 LOW 3.7 User Registration & Membership < 5.2.8 - Unauthenticated User Data Disclosure via Membership Thank You Page WordPress pluginUser Registration & Membership
The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's email address, profile fields, role and membership order details. Exploitation requires the site owner to have added a user smart tag to that page's configurable message, which the shipped default does not contain.
-
CVE-2026-86406 HIGH 7.5 User Registration & Membership < 5.2.8 - Subscriber+ Privilege Escalation via Membership Purchase WordPress pluginUser Registration & Membership
The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role attached to a paid plan without paying for it. Where the site owner has mapped a plan to a privileged role, this leads to privilege escalation up to administrator.
-
CVE-2026-82851 LOW 2.7 Masteriyo LMS 1.14.0 - 3.4.0 - Instructor+ Arbitrary Post Disclosure via IDOR WordPress pluginMasteriyo LMS
The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft courses.
-
CVE-2026-82847 MEDIUM 6.8 Masteriyo LMS < 3.4.1 - Instructor+ Stored XSS via Course Highlights WordPress pluginMasteriyo LMS
The Masteriyo LMS WordPress plugin before 3.4.1 does not sanitise and escape one of its course fields before outputting it back in the course editor, allowing users with the instructor role to perform Stored Cross-Site Scripting attacks against higher privileged users such as administrators.
-
CVE-2026-82845 CRITICAL 9.9 Masteriyo LMS < 3.4.1 - Subscriber+ PHP Object Injection WordPress pluginMasteriyo LMS
The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS WordPress plugin before 3.4.1, write and execute arbitrary code on the server. A weaker form of the same issue is reachable without an account and yields an arbitrary file write rather than code execution.
-
CVE-2026-77705 HIGH 7.2 Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover WordPress pluginBooking for Appointments and Events Calendar
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the password and email address of other users' WordPress accounts and take them over.
-
CVE-2026-85132 MEDIUM 4.3 WPLP Cookie Consent 4.0.2 - 4.4.1 - Subscriber+ Cookie Scan Schedule Disclosure via gcc_get_schedule_scan WordPress pluginWPLP Cookie Consent
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured.
-
CVE-2026-82848 MEDIUM 5.3 Masteriyo LMS 1.3.1 - 2.3.3 - Unauthenticated Course Enrollment Disclosure WordPress pluginMasteriyo LMS
The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enrolment record over its REST API, allowing unauthenticated users to read any learner's enrolment status, timestamps and course-progress data by walking sequential record identifiers. A related gap lets any enrolled user retrieve other learners' enrolment records as well.
-
CVE-2026-84221 MEDIUM 6.8 Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID WordPress pluginKirki
The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials.
-
CVE-2026-15386 MEDIUM 5.4 Meow Gallery < 5.5.2 - Author+ Stored XSS via Attachment Alt-Text WordPress pluginMeow Gallery
The Meow Gallery WordPress plugin before 5.5.2 does not escape an attachment's alt text before outputting it into an attribute of the link it builds for linked galleries, allowing users with the Author role or above to store a JavaScript payload that executes in the browser of any visitor (including administrators) who views a post containing such a gallery.
This page is generated automatically from the CVE Program record cache and reflects the CVE records as of 26 October 2026. The underlying data is also available as JSON.