CVE-2026-57742Published
WordPress Kids Planet theme <= 2.2.14.2 - Cross Site Scripting (XSS) vulnerability
cve-program ·
Vendor product: Kids Planet
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
695772 source statements · aliases may refer to the same vulnerabilityCVE-2026-12980Published
Post Snippets <= 4.2.4 - Contributor+ Stored XSS via Snippet Variable
cve-program ·
Vendor product: Post Snippets
CVE-2026-94235Published
Simple User Registration <= 6.9 - Subscriber+ Arbitrary Email Sending via wpr_send_email_to_user
cve-program ·
Vendor product: MemberHero
CVE-2026-103305Published
Prenotazioni <= 1.7.5 - Unauthenticated Stored XSS via Settings Update
cve-program ·
Vendor product: Prenotazioni
CVE-2026-103694Published
Mobile builder <= 1.4.2 - Subscriber+ Privilege Escalation to Admin
cve-program ·
Vendor product: Mobile builder
CVE-2026-103695Published
Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'vendor_id' Parameter
cve-program ·
Vendor product: Mobile builder
CVE-2026-104028Published
Anton Extensions <= 1.2.2 - Unauthenticated Arbitrary File Upload to RCE
cve-program ·
Vendor product: Anton Extensions
CVE-2026-104680Published
Envira Gallery < 1.16.2 - Multisite Subsite Admin+ Arbitrary Plugin Installation via Onboarding Wizard
cve-program ·
Vendor product: Envira Gallery
CVE-2026-104681Published
Envira Gallery < 1.16.2 - Author+ Non-Public Post Title and Excerpt Disclosure via Gallery REST Field
cve-program ·
Vendor product: Envira Gallery
CVE-2026-104682Published
Envira Gallery < 1.16.2 - Contributor Missing Authorization via Convert Gallery REST Route
cve-program ·
Vendor product: Envira Gallery
CVE-2026-62036Published
WordPress All Bootstrap Blocks plugin <= 1.3.31 - Sensitive Data Exposure vulnerability
cve-program ·
https://wordpress.org/plugins: all-bootstrap-blocks
CVE-2026-66480Published
WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Sensitive Data Exposure vulnerability
cve-program ·
https://wordpress.org/plugins: yith-woocommerce-product-add-ons
CVE-2026-104684Published
Envira Gallery < 1.16.2 - Author+ IDOR via Shortcode
cve-program ·
Vendor product: Envira Gallery
CVE-2026-106029Published
WeddingCity Lite <= 1.0.4 - Unauthenticated Arbitrary Post and Attachment Deletion
cve-program ·
Vendor product: WeddingCity Lite
CVE-2026-107507Published
Squadeno < 1.12.0 - Trainer+ Section and Age Group Reassignment via Quick Edit
cve-program ·
Vendor product: Squadeno
CVE-2026-107694Published
Dokan < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure via Commission REST Endpoint
cve-program ·
Vendor product: Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
CVE-2026-14854Published
WooCommerce Bookings < 3.11.0 - Unauthenticated Denial of Service
cve-program ·
Vendor product: WooCommerce Bookings
CVE-2026-81153Published
Robo Gallery < 5.2.6 - Author+ Stored XSS via Image Overlay Effect Meta
cve-program ·
Vendor product: Robo Gallery
CVE-2026-81154Published
Robo Gallery < 5.2.6 - Author+ Stored XSS via Image Alt Text
cve-program ·
Vendor product: Robo Gallery
CVE-2026-81155Published
Robo Gallery < 5.2.6 - Author+ Stored XSS via Gallery Search Label
cve-program ·
Vendor product: Robo Gallery
CVE-2026-81156Published
Robo Gallery < 5.2.6 - Contributor+ Stored XSS via Gallery Settings
cve-program ·
Vendor product: Robo Gallery
CVE-2026-81420Published
Tcard WP <= 1.8.0 - Unauthenticated SQLi via group_id Parameter
cve-program ·
Vendor product: Tcard WP
CVE-2026-81649Published
Fundiin <= 3.4.0 - Unauthenticated Payment Gateway Settings Update and Credential Disclosure
cve-program ·
Vendor product: Fundiin cho WooCommerce
CVE-2026-84251Published
click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Arbitrary Options Update
cve-program ·
Vendor product: click5 CRM add-on to Ninja Forms
CVE-2026-84252Published
click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Arbitrary Options Update
cve-program ·
Vendor product: click5 CRM add-on to WPForms
CVE-2026-84253Published
click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Arbitrary Options Update
cve-program ·
Vendor product: click5 CRM add-on to Gravity Forms
CVE-2026-84254Published
click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Arbitrary Options Update
cve-program ·
Vendor product: click5 CRM add-on to Contact Form 7
CVE-2026-84258Published
click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Stored XSS via post_notifications
cve-program ·
Vendor product: click5 CRM add-on to Ninja Forms
CVE-2026-84259Published
click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications
cve-program ·
Vendor product: click5 CRM add-on to WPForms
CVE-2026-84260Published
click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications
cve-program ·
Vendor product: click5 CRM add-on to Gravity Forms
CVE-2026-84261Published
click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored XSS via post_notifications
cve-program ·
Vendor product: click5 CRM add-on to Contact Form 7
CVE-2026-84734Published
Mindstien Quick Login <= 1.0 - Unauthenticated Administrator Account Takeover via 'mql_pass' Parameter
cve-program ·
Vendor product: Mindstien Quick Login
CVE-2026-84737Published
Freeton WP <= 1.0.0 - Unauthenticated Account Takeover via 'secod' Parameter
cve-program ·
Vendor product: Freeton WP
CVE-2026-85118Published
AI Content Generator Marketing <= 1.0.0 - Unauthenticated Privilege Escalation via Arbitrary Option Update and Deletion
cve-program ·
Vendor product: AI Content Generator Marketing
CVE-2026-85121Published
Insurify <= 1.0 - Unauthenticated Arbitrary Option Creation and Overwrite via saveemailtemplatedesign
cve-program ·
Vendor product: Insurify
CVE-2026-85126Published
Crowdfundly <= 2.2.2 - Crowdfundly Manager+ Privilege Escalation
cve-program ·
Vendor product: Crowdfundly
CVE-2026-86706Published
Quick quotes <= 1.0.0 - Unauthenticated Integer-Value Option Update
cve-program ·
Vendor product: Quick quotes
CVE-2026-86717Published
Insurify <= 1.0 - Unauthenticated Arbitrary Option Deletion via removeimg_popup
cve-program ·
Vendor product: Insurify
CVE-2026-86798Published
HootBoard <= 3.1.4 - Unauthenticated Stored XSS via Board Configuration REST Endpoint
cve-program ·
Vendor product: HootBoard
CVE-2026-87760Published
Web Vitals Tracking <= 5.4.2 - Unauthenticated Stored XSS via Tracking Beacon Metric Name
cve-program ·
Vendor product: Web Vitals Tracking
CVE-2026-87761Published
Adwised Web Push Notification <= 2.5.7 - Subscriber+ Stored XSS via Pop-up Settings
cve-program ·
Vendor product: Adwised Web Push Notification
CVE-2026-87762Published
Adwised Web Push Notification <= 2.5.7 - Unauthenticated Stored XSS via Secret Key Type Juggling
cve-program ·
Vendor product: Adwised Web Push Notification
CVE-2026-87764Published
BuddyPress Instant Chat <= 1.6 - Unauthenticated Stored XSS via Chat Message
cve-program ·
Vendor product: BuddyPress Instant Chat
CVE-2026-88785Published
Simple Membership < 4.8.3 - Newly Registered Member Password Disclosure via URL Query String
cve-program ·
Vendor product: Simple Membership
CVE-2026-88826Published
SmugMug Embed <= 3.13 - Unauthenticated Stored XSS via saveSelectedAlbums
cve-program ·
Vendor product: SmugMug Embed
CVE-2026-88827Published
Disable Users <= 1.0.5 - Disabled Account Authentication Bypass via XML-RPC and Application Passwords
cve-program ·
Vendor product: Disable Users
CVE-2026-88903Published
Topcontent <= 1.2.1 - Unauthenticated Stored XSS via Content Webhook
cve-program ·
Vendor product: Topcontent
CVE-2026-88905Published
KeyWord Collector <= 1.4 - Unauthenticated Stored XSS and Settings Update via WPKeyWordSettings
cve-program ·
Vendor product: KeyWord Collector
CVE-2026-88930Published
Social Web Suite <= 4.1.12 - Unauthenticated Blind SQLi via Unset Shared Secret
cve-program ·
Vendor product: Social Web Suite
CVE-2026-89195Published
Site Setup Wizard <= 1.5.8 - Unauthenticated SQLi via ssw_check_admin_email_exists
cve-program ·
Vendor product: Site Setup Wizard
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.