Skip to content
Fencer Intel

All · WordPress

Newest first, late arrivals on top. Also a feed.

  1. 6.5
    CVE-2026-118698 JoomSport <= 5.7.14 - Authenticated (Contributor+) SQL Injection via 'pgroup' Shortcode Attribute
    WordPress
  2. 6.5
    CVE-2026-118194 Page and Post Restriction <= 1.6.1 - Unauthenticated Authentication Bypass via REST API Nonce Bypass via Cookie Re-Authentication
    WordPress
  3. 6.5
    CVE-2026-5461 Forminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata
    WordPress
  4. 8.8
    CVE-2026-104368 Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info Field
    WordPress
  5. —
    GHSA-4w3m-c66w-69mg A race condition during core updates that could lead to remote code execution
    WordPress unreviewed · maintainers only
  6. —
    GHSA-p2r6-rwjp-phv3 An information disclosure issue exposing unpublished Customizer changes to unauthenticated visitors
    WordPress unreviewed · maintainers only
  7. —
    GHSA-vchg-92fx-636p A permissions issue letting custom roles that moderate comments read, edit and delete notes on posts they can't edit
    WordPress unreviewed · maintainers only
  8. —
    GHSA-mqjw-vvgg-xfvf An Editor+ stored cross-site scripting (XSS) issue in the personal data erasure requests screen
    WordPress unreviewed · maintainers only
  9. —
    GHSA-j3rg-rwgx-7wx7 Unescaped usernames on the multisite Network Users screens, fixed as a hardening measure
    WordPress unreviewed · maintainers only
  10. —
    GHSA-9vrg-x932-q57q A Contributor+ stored cross-site scripting (XSS) issue in Customizer selective refresh
    WordPress unreviewed · maintainers only
  11. —
    GHSA-j255-3x8q-7q7g A Contributor+ stored cross-site scripting (XSS) issue in the labels of the Comments Pagination and Post Navigation Link blocks
    WordPress unreviewed · maintainers only
  12. —
    GHSA-wjwj-p342-9fq7 An issue allowing post content to shadow Script Module data with a matching element ID
    WordPress unreviewed · maintainers only
  13. —
    GHSA-7q86-3j97-744j A cross-site scripting (XSS) issue in the Categories block via format string injection
    WordPress unreviewed · maintainers only
  14. —
    GHSA-2p22-wv7j-cvfv A hardening fix for unsafe preg_replace() replacements in the Image and Playlist blocks
    WordPress unreviewed · maintainers only
  15. —
    GHSA-83c2-c4pc-wmp3 Contributor+ stored cross-site scripting (XSS) and denial of service issues in Interactivity API bindings
    WordPress unreviewed · maintainers only
  16. 6.5
    CVE-2026-118084 WordPress Hotel Booking plugin <= 3.8 - Insecure Direct Object References (IDOR) vulnerability
    WordPress
  17. 7.5
    CVE-2026-118083 WordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerability
    WordPress
  18. 8.8
    CVE-2026-118082 WordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerability
    WordPress
  19. 8.8
    CVE-2026-118081 WordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerability
    WordPress
  20. 8.8
    CVE-2026-118080 WordPress Social Snap plugin <= 1.5.4 - PHP Object Injection vulnerability
    WordPress
  21. 7.2
    CVE-2026-118079 WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - PHP Object Injection vulnerability
    WordPress
  22. 7.2
    CVE-2026-118078 WordPress Product Catalog Feed by PixelYourSite plugin <= 3.1.4 - PHP Object Injection vulnerability
    WordPress
  23. 7.2
    CVE-2026-118077 WordPress Sastra Essential Addons for Elementor plugin <= 1.2.3 - PHP Object Injection vulnerability
    WordPress
  24. 8.8
    CVE-2026-118076 WordPress Frisbii Pay plugin <= 1.8.19 - PHP Object Injection vulnerability
    WordPress
  25. 8.8
    CVE-2026-118075 WordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability
    WordPress
  26. 7.2
    CVE-2026-118074 WordPress Finale Lite plugin <= 2.21.0 - PHP Object Injection vulnerability
    WordPress
  27. 8.8
    CVE-2026-118073 WordPress News Kit Elementor Addons plugin <= 1.5.0 - PHP Object Injection vulnerability
    WordPress
  28. 7.2
    CVE-2026-116869 WordPress myPOS Checkout plugin <= 1.4.5 - PHP Object Injection vulnerability
    WordPress
  29. 8.8
    CVE-2026-116868 WordPress BuddyPress Xprofile Custom Field Types plugin <= 1.3.1 - PHP Object Injection vulnerability
    WordPress
  30. 8.8
    CVE-2026-116867 WordPress Dynamic QR Code – generator plugin <= 1.0.1 - PHP Object Injection vulnerability
    WordPress