Skip to content
Fencer Intel

All · WordPress

Newest first, late arrivals on top. Also a feed.

  1. 7.2
    CVE-2026-118043 Bulk Media Register < 2.01 - Author+ Arbitrary File Move via Path Traversal
    WordPress
  2. 4.2
    CVE-2026-110808 Essential Addons for Elementor 6.6.0 - 6.8.7 - Author+ Privilege Escalation via register_user_role
    WordPress
  3. 4.9
    CVE-2026-110042 Payment Forms for Paystack < 4.0.6 - Contributor+ Sensitive Information Disclosure via Settings Page
    WordPress
  4. 7.2
    CVE-2026-116520 PPWP <= 1.9.26 - Unauthenticated Stored Cross-Site Scripting via '[ppwp]' Shortcode 'desc_below_form' Attribute via Placeholder Marker Collision
    WordPress
  5. 6.5
    CVE-2026-100155 Ninja Forms <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution via 'formData' Field Value via Success Message Merge Tag
    WordPress
  6. 6.5
    CVE-2026-92294 Spectra Gutenberg Blocks <= 2.20.4 - Missing Authorization to Unauthenticated Limited Theme File Deletion and Modification via 'page', 'path', and 'settings' GET Parameters
    WordPress
  7. 7.2
    CVE-2026-109997 Ninja Forms <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalization
    WordPress
  8. 8.1
    CVE-2026-119977 WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
    WordPress
    kev EPSS 1.2% chance of exploitation in 30 days, percentile 68%
  9. 7.2
    CVE-2026-109234 Meow Lightbox <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronization
    WordPress
  10. 5.4
    CVE-2026-116563 Photo Gallery, Sliders, Proofing and Themes <= 4.5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment `title` Attribute via Shutter Lightbox innerHTML
    WordPress
  11. 5.4
    CVE-2026-101326 Ninja Forms <= 3.15.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via '{wp:user_display_name}' Merge Tag via display_name
    WordPress
  12. 7.5
    CVE-2026-111578 PDF Invoices & Packing Slips for WooCommerce 5.16.2 - 5.16.4 - Unauthenticated Stored XSS via Order Address and Customer Note Fields
    WordPress
  13. 8.8
    CVE-2026-118090 WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerability
    WordPress
  14. 7.2
    CVE-2026-118089 WordPress Product Feed Manager plugin <= 7.14.1 - PHP Object Injection vulnerability
    WordPress
  15. 8.8
    CVE-2026-118086 WordPress WP BASE Booking plugin <= 6.5.2 - Privilege Escalation vulnerability
    WordPress
  16. 7.5
    CVE-2026-116862 WordPress WP REST Cache plugin <= 2026.3.1 - Broken Access Control vulnerability
    WordPress
  17. 7.5
    CVE-2026-116861 WordPress Flexible Chat plugin <= 1.1.0 - Sensitive Data Exposure vulnerability
    WordPress
  18. 6.5
    CVE-2026-116854 WordPress WP Customer Area plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability
    WordPress
  19. 6.5
    CVE-2026-116853 WordPress GiveWP plugin <= 4.19.0.1 - Broken Access Control vulnerability
    WordPress
  20. 9.1
    CVE-2026-116852 WordPress Widget Options plugin <= 4.2.5 - Remote Code Execution (RCE) vulnerability
    WordPress
  21. 7.1
    CVE-2026-116851 WordPress eCommerce Product Catalog plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerability
    WordPress
  22. 7.1
    CVE-2026-116847 WordPress Mang Board WP plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability
    WordPress
  23. 6.5
    CVE-2026-116410 WordPress Masteriyo - LMS plugin <= 3.4.3 - Arbitrary Content Deletion vulnerability
    WordPress
  24. 7.1
    CVE-2026-116405 WordPress VikRentCar plugin <= 1.4.9 - Cross Site Scripting (XSS) vulnerability
    WordPress
  25. 7.5
    CVE-2026-116401 WordPress HUSKY plugin <= 1.4.6 - Broken Access Control vulnerability
    WordPress
  26. 9.8
    CVE-2026-116386 WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerability
    WordPress
  27. 6.5
    CVE-2026-115947 WordPress HUSKY plugin <= 1.4.6 - Sensitive Data Exposure vulnerability
    WordPress
  28. 5.0
    CVE-2026-115604 WordPress SureDash plugin <= 1.12.3 - Arbitrary File Deletion vulnerability
    WordPress
  29. 6.5
    CVE-2026-114711 WordPress MultiVendorX plugin <= 5.0.20 - Cross Site Scripting (XSS) vulnerability
    WordPress
  30. 5.3
    CVE-2026-107868 WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Bypass Vulnerability vulnerability
    WordPress