CVE-2026-77820Published
WPComplete <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute
cve-program ·
Vendor product: WPComplete
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699233 source statements · aliases may refer to the same vulnerabilityCVE-2026-89333Published
Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter
cve-program ·
Vendor product: Tutor LMS – eLearning and online course solution
CVE-2026-15660Published
SEO Booster <= 7.4.7 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Modification via handle_oauth_callback()
cve-program ·
Vendor product: SEO Booster
CVE-2026-13354Published
Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content
cve-program ·
Vendor product: Asset CleanUp: Page Speed Booster
CVE-2026-15760Published
Divi Essentials <= 5.8.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via dnxte_get_database_data AJAX Action
cve-program ·
Vendor product: Divi Essentials
CVE-2026-87909Published
WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection
cve-program ·
Vendor product: WP Photo Album Plus
CVE-2026-84434Published
Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field
cve-program ·
Vendor product: Gravity Forms
CVE-2026-92229Published
Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter
cve-program ·
Vendor product: Forminator Forms – Contact Form, Payment Form & Custom Form Builder
CVE-2026-88944Published
Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter
cve-program ·
Vendor product: Tutor LMS – eLearning and online course solution
CVE-2026-89334Published
Better Messages <= 2.15.33 - Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via '/thread/<id>' REST Endpoint
cve-program ·
Vendor product: Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
CVE-2026-89274Published
WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content
cve-program ·
Vendor product: WP Recipe Maker
CVE-2026-89081Published
Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters
cve-program ·
Vendor product: Tutor LMS – eLearning and online course solution
CVE-2026-89093Published
Better Messages <= 2.15.33 - Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/register
cve-program ·
Vendor product: Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
CVE-2026-92967Published
Pochipp <= 1.20.2 - Reflected Cross-Site Scripting via 'keyword' Parameter
cve-program ·
Vendor product: Pochipp
CVE-2026-12042Published
WP2Social Auto Publish <= 2.4.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' Parameter
cve-program ·
Vendor product: WP2Social Auto Publish
CVE-2026-92807Published
Save as PDF Plugin by PDFCrowd <= 4.6.1 - Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attribute
cve-program ·
Vendor product: Save as PDF Plugin by PDFCrowd
CVE-2026-9615Published
Flex Import <= 3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'license_activate_fleximp' and 'license_deactivate_fleximp' AJAX Actions
cve-program ·
Vendor product: Flex Import
CVE-2026-11608Published
WP Customer Reviews <= 3.7.8 - Reflected Cross-Site Scripting via 'wpcr3_fname' Parameter
cve-program ·
Vendor product: WP Customer Reviews
CVE-2026-15664Published
Quill Forms | Conversational Multi Step Forms, Surveys & quizzes <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting via Multiple Choice 'Other' Value
cve-program ·
Vendor product: Quill Forms | Conversational Multi Step Forms, Surveys & quizzes
CVE-2026-11899Published
PDF Builder for WooCommerce. Create invoices,packing slips and more <= 2.0.11 - Missing Authorization to Authenticated (Subscriber+) Sensitive Invoice Data Disclosure via GetInvoiceDetail AJAX Handler
cve-program ·
Vendor product: PDF Builder for WooCommerce. Create invoices,packing slips and more
CVE-2026-15947Published
Search Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Site-Wide Option Modification via 'metasync_post_types' Parameter
cve-program ·
Vendor product: Search Atlas SEO – OTTO AI SEO Automation for WordPress
CVE-2026-4792Published
Bread <= 2.9.12 - Missing Authorization to Unauthenticated Information Exposure
cve-program ·
Vendor product: Bread
CVE-2026-2278Published
VW Writer Blog <= 1.3.8 - Missing Authorization to Authenticated (Subscriber+) Theme Settings Reset
cve-program ·
Vendor product: VW Writer Blog
CVE-2026-9832Published
Payment Gateway of Stripe for WooCommerce <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint
cve-program ·
Vendor product: Payment Gateway of Stripe for WooCommerce
CVE-2026-1242Published
BlockSpare - Gutenberg Site Builder Blocks & Starter Sites <= 4.2.6 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation
cve-program ·
Vendor product: BlockSpare – Gutenberg Blocks for News, Magazine, Blog & Business Websites
CVE-2026-13770Published
AppMySite <= 3.15.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via save_ams_license_key AJAX Handler
cve-program ·
Vendor product: AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker)
CVE-2026-13191Published
Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order_by' Parameter
cve-program ·
Vendor product: Create
CVE-2026-6295Published
WP Optimizer <= 2.5.0 - Authenticated (Administrator+) SQL Injection via 's' Parameter
cve-program ·
Vendor product: WP Optimizer – PageSpeed, Cache, Minify & Core Web Vitals
CVE-2026-15946Published
Search Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Whitelabel Password Modification via handle_whitelabel_password_early Function
cve-program ·
Vendor product: Search Atlas SEO – OTTO AI SEO Automation for WordPress
CVE-2026-15463Published
SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' and 'host' Parameters
cve-program ·
Vendor product: SSL Zen — SSL Certificate Installer & HTTPS Redirects
CVE-2026-9232Published
Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action
cve-program ·
Vendor product: Easy Appointments
CVE-2026-4327Published
The Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' Parameter
cve-program ·
Vendor product: The Welcomizer
CVE-2026-2422Published
WP Composer <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pbwp_raw_shortcode' Shortcode
cve-program ·
Vendor product: WP Composer – The Easiest Page Builder
CVE-2026-1641Published
Wow Elements Addons for Elementor <= 1.11.2 - Authenticated (Contributor+) Server-Side Request Forgery via Changelog File Setting
cve-program ·
Vendor product: Wow Elements Addons for Elementor
CVE-2026-13200Published
Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order' Parameter
cve-program ·
Vendor product: Create
CVE-2026-75959Published
GoPay for WooCommerce <= 1.0.36 - Authenticated (Shop Manager+) SQL Injection via 'log_table_filter' Parameter
cve-program ·
Vendor product: GoPay for WooCommerce
CVE-2026-12402Published
OTP Login & Register Woocommerce <= 2.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'fb-config' Setting
cve-program ·
Vendor product: OTP Login & Register Woocommerce
CVE-2026-85658Published
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket)
cve-program ·
Vendor product: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
CVE-2026-7527Published
WP Ghost (Hide My WP Ghost) <= 7.0.02 - Unauthenticated Open Redirect via 'redirect_to' Parameter
cve-program ·
Vendor product: Hide My WP Ghost – Security & Firewall
CVE-2026-5400Published
Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User Input
cve-program ·
Vendor product: Redux Framework
CVE-2026-9855Published
Custom Field Template <= 2.7.8 - Authenticated (Contributor+) SQL Injection via 'post_ID' Parameter
cve-program ·
Vendor product: Custom Field Template
CVE-2026-1984Published
Ibtana – Ecommerce Product Addons <= 0.4.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'iepa_use_gt_editor' AJAX Action
cve-program ·
Vendor product: Ibtana – Ecommerce Product Addons
CVE-2026-87917Published
MC4WP: Mailchimp for WordPress <= 4.14.0 - Reflected Cross-Site Scripting via 'data' Dynamic Content Tag
cve-program ·
Vendor product: MC4WP: Mailchimp for WordPress
CVE-2026-15098Published
Real 3D Flipbook <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightboxtext' Shortcode Attribute
cve-program ·
Vendor product: Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder
CVE-2026-5410Published
Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input
cve-program ·
Vendor product: Redux Framework
CVE-2026-8354Published
Gum Addon for Elementor <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pop_tag' Widget Setting
cve-program ·
Vendor product: Gum Addon for Elementor
CVE-2026-18346Published
TikTok <= 1.4.1 - Missing Authorization to Unauthenticated TikTok Integration Takeover via 'auth_code' Parameter
cve-program ·
Vendor product: TikTok
CVE-2026-1255Published
YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Unauthenticated Information Disclosure in 'ysleadgen_get_captured_data' AJAX Action
cve-program ·
Vendor product: YS LeadGen – Popup Builder, Popup Maker & Form Builder for WordPress | Lead Generation, Email Marketing, Sales, Conversions, Opt-Ins & Subscribers
CVE-2026-9289Published
WordLift <= 3.54.10 - Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints
cve-program ·
Vendor product: WordLift – AI powered SEO – Schema
CVE-2026-9766Published
Empik for Woocommerce <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Product Meta Update via empik_csv_process_emp_log_classes AJAX Action
cve-program ·
Vendor product: Empik for Woocommerce
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.