CVE

Official account maintained by the CVE™ Program to notify the community of new CVE IDs. Posts contain abbreviated details. Full CVE Records on

[CVE @CVEnew]

CVE-2026-110017 The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, a… https://t.co/yYmW29IZ8M

[CVE @CVEnew]

CVE-2026-103999 The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 d… https://t.co/pcyEd3ftFs

[CVE @CVEnew]

CVE-2026-107748 The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… https://t.co/2M6Nf6zbud

[CVE @CVEnew]

CVE-2026-95686 The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site … https://t.co/yWZej7P3Il

[CVE @CVEnew]

CVE-2026-95809 The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site … https://t.co/2catAUYNa7

[CVE @CVEnew]

CVE-2026-109232 The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[<checko… https://t.co/sR8MSajtKw

[CVE @CVEnew]

CVE-2026-89051 The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHeadersAndTags' function in ve… https://t.co/dpv88xAyG4

[CVE @CVEnew]

CVE-2026-111122 The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 … https://t.co/9gkiMAXpLL

[CVE @CVEnew]

CVE-2026-107764 The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter in all versions up to, a… https://t.co/47MHTFW06Y

[CVE @CVEnew]

CVE-2026-109513 The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress… https://t.co/Nmv81tS60D

[CVE @CVEnew]

CVE-2026-104932 The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This … https://t.co/pQufNS9trD

[CVE @CVEnew]

CVE-2026-85659 The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists … https://t.co/t4C6DGycAn

[CVE @CVEnew]

CVE-2026-88963 The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirect_url' parameter in versions… https://t.co/eFznLlyaFd

[CVE @CVEnew]

CVE-2026-100186 The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… https://t.co/a2mKBxhnbG

[CVE @CVEnew]

CVE-2026-91833 The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attack… https://t.co/yYSKFlfV2I

[CVE @CVEnew]

CVE-2026-91830 The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter, allowing unauthenticated attackers to di… https://t.co/hUYn8Reyqk

[CVE @CVEnew]

CVE-2026-92427 The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing i… https://t.co/dRP3rfqZGV

[CVE @CVEnew]

CVE-2026-74923 The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gallery on demand, allowing unauthenticated u… https://t.co/yRqIkHCYb5

[CVE @CVEnew]

CVE-2026-103696 The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to per… https://t.co/rQx2dfm1LE

[CVE @CVEnew]

CVE-2026-105973 The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user (Su… https://t.co/vxWnI6IpVy