Skip to content
Fencer Intel

All · WordPress

Newest first, late arrivals on top. Also a feed.

  1. 8.8
    CVE-2026-76010 Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal
    WordPress
  2. 6.4
    CVE-2026-116752 GeoDirectory <= 2.8.197 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_images' Image Title Delimiter Injection
    WordPress
  3. 5.3
    CVE-2026-101325 Newsletters <= 4.18.1 - Authenticated (Subscriber+) SQL Injection via 'id' Parameter
    WordPress
  4. 7.2
    CVE-2026-110530 FeedWordPress <= 2026.0517 - Unauthenticated Stored Cross-Site Scripting via Syndicated Feed Content
    WordPress
  5. 7.2
    CVE-2026-120075 WP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site Scripting
    WordPress
  6. 9.1
    CVE-2026-103882 Acadlix LMS <= 1.1.9 - Unauthenticated Arbitrary File Deletion via 'delete_file_data.file_path' Parameter
    WordPress
  7. 6.4
    CVE-2026-119160 Smart Post <= 4.0.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User display_name via Author Filter block
    WordPress
  8. 5.3
    CVE-2026-109367 All in One SEO <= 5.0.3 - Unauthenticated Sensitive Information Disclosure in 's' Search Query Parameter
    WordPress
  9. 9.8
    CVE-2026-118235 SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_data
    WordPress
  10. 5.3
    CVE-2026-103915 Booking for Appointments and Events Calendar <= 2.4.12 - Unauthenticated Sensitive Information Exposure in 'page' Parameter
    WordPress
  11. 8.8
    CVE-2026-120070 User Frontend <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameter
    WordPress
  12. 8.1
    CVE-2026-103898 Wp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login Callback
    WordPress
  13. 5.4
    CVE-2026-111070 Content Pilot <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via RSS-linked article `<meta name="description">`
    WordPress
  14. 7.2
    CVE-2026-107759 WPO365 | MICROSOFT 365 GRAPH MAILER <= 6.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject via wp_mail
    WordPress
  15. 9.8
    CVE-2026-116512 Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection
    WordPress
  16. 6.5
    CVE-2026-103997 Redux Framework <= 4.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via /wp-admin/profile.php inline redux_<opt_name> JavaScript
    WordPress
  17. 4.3
    CVE-2025-11455 Perfect Images <= 7.2.0 - Missing Authorization to Authenticated (Author+) Image Replacement
    WordPress
  18. 6.5
    CVE-2025-9462 WP2LEADS <= 3.5.6 - Authenticated (Subscriber+) SQL Injection via order Parameter
    WordPress
  19. 6.1
    CVE-2026-103962 User Frontend <= 4.3.13 - Reflected Cross-Site Scripting via 'field_attr[required]' Parameter
    WordPress
  20. 6.4
    CVE-2026-116535 SEOPress <= 10.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Profile Field via %%archive_title%% Template Tag
    WordPress
  21. 9.8
    CVE-2026-119096 Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter
    WordPress
  22. 7.2
    CVE-2026-118057 Shield Security <= 22.3.2 - Unauthenticated Stored Cross-Site Scripting via Request Path (REQUEST_URI) in Traffic Log
    WordPress
  23. 5.9
    CVE-2026-110023 WP Data Access <= 5.5.88 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'rel_tab' Parameter
    WordPress
  24. 6.4
    CVE-2026-111592 Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.17.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name profile-sync into author term name
    WordPress
  25. 8.8
    CVE-2026-104012 Rox Appointment Booking <= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking' Endpoint
    WordPress
  26. 5.3
    CVE-2026-11396 Product Filter for WooCommerce by WBW <= 3.4.6 - Missing Authorization to Unauthenticated Information Disclosure via filterSettings[default_query] Parameter
    WordPress
  27. 4.3
    CVE-2026-109386 Hustle <= 7.8.14.3 - Missing Authorization to Authenticated (Custom+) ESP Credential Overwrite and Irreversible OAuth Token Deletion via 'hustle_provider_migrate_hubspot' (and sibling migrate_*) AJAX Action
    WordPress
  28. 5.3
    CVE-2026-119166 Welcart e-Commerce <= 2.12.5 - Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member[ID]' Parameter
    WordPress
  29. 7.2
    CVE-2026-119065 Shipping Zones by Drawing for WooCommerce <= 3.3.0 - Unauthenticated Stored Cross-Site Scripting via 'szbd-picked' Checkout Parameter
    WordPress
  30. 5.3
    CVE-2026-109217 PDF Invoices & Packing Slips for WooCommerce <= 5.16.5 - Unauthenticated Sensitive Information Exposure via Yearly-Reset Invoice Attachment Cache
    WordPress