CVE-2026-90952

WP Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated Site-Wide Access Mode Bypass via REST API

The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Wp Edit Password Protected

CVE-2026-90987

Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenticated Payment Amount Manipulation via Client-Supplied Price

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Easy Paypal & Stripe Buy Now Button

CVE-2026-91020

WebToffee Gift Cards for WooCommerce < 1.3.1 - Unauthenticated Gift Card Amount Manipulation via wt_credit_amount

The WebToffee Gift Cards for WooCommerce WordPress plugin before 1.3.1 does not validate a user-supplied gift card amount server-side before using it as the cart-item price and store-credit coupon value, allowing unauthenticated users to submit an arbitrary or negative amount, bypassing the configured denominations and manipulating the order total to obtain products without paying.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Webtoffee Gift Cards For Woocommerce

CVE-2026-92924

Unlimited Elements For Elementor < 2.0.21 - Subscriber+ Arbitrary Shortcode Execution via get_addon_output_data

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it, allowing users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site. Version 2.0.18 removed the subscriber-level access, so from 2.0.18 onward the issue requires a Contributor role or above.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Unlimited Elements For Elementor

CVE-2026-97219

MStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via 'status' Parameter

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mstore Wordpress-extensions

Products

Mstore Api Mstore Api

CVE-2026-97663

Customer Reviews for WooCommerce <= 5.122.0 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 5.122.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the image attachment feature (ivole_attach_image) to be enabled, which allows unauthenticated attackers to both submit a review with an entity-encoded malicious author name and upload an attached image via the publicly accessible wp_ajax_nopriv_cr_upload_local_images_frontend endpoint.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Ivole Wordpress-extensions

Products

Customer Reviews For Woocommerce Customer Reviews For Woocommerce

CVE-2026-96578

GSpeech TTS <= 3.22.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.22.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This mXSS-style transform bypasses WordPress comment kses sanitization because the payload is stored using only kses-allowed tags and attributes; the malicious event handlers and style fragments become active only when the plugin's output-buffer callback rewrites the rendered HTML at request time.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Creative-solutions-1 Wordpress-extensions

Products

Gspeech Tts Wordpress Text To Speech Plugin Gspeech Tts

CVE-2026-96567

MW WP Form <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'post_id' Parameter (via stored form-submitted post meta)

The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_id' parameter in all versions up to, and including, 5.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The CSRF gate protecting form submission (MW_WP_Form_Csrf) is bypassable by any unauthenticated visitor who first loads the public form page to obtain a valid double-submit cookie, leaving no effective barrier to storing malicious payloads.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Web-soudan Wordpress-extensions

Products

Mw Wp Form Mw Wp Form

CVE-2026-93880

Greenshift <= 13.2.0 - Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder in all versions up to, and including, 13.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This requires a site administrator to have configured an element block's Custom JS field to include a {{GET:...}} placeholder and for that JS to contain the token 'import', which routes the substituted value to the unescaped raw echo branch inside a &lt;script type="module"&gt; tag.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpsoul

Products

Greenshift Greenshift

CVE-2026-97336

CMB2 <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'file_list' Field Type in all versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when an integrating plugin or theme registers a file_list field on a publicly accessible front-end form or a user meta box, as CMB2 is a developer library and does not expose these fields by default.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Jtsternberg Wordpress-extensions

Products

Cmb2 Cmb2

CVE-2026-95817

DoFollow Case by Case <= 3.6.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Comment moderation delays but does not prevent exploitation — once an administrator approves the visually innocuous comment, the stored payload executes in the browser of every subsequent visitor to the affected post.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Apasionados Wordpress-extensions

Products

Dofollow Case By Case Dofollow Case By Case

CVE-2026-102772

CMB2 <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'textarea_code' Field

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<textarea_code field id> (e.g. kl_code, kl_post_code)' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The front-end save path requires only a CMB2 box nonce, which is emitted to all visitors including unauthenticated guests via a simple GET request, making the attack trivially reachable without any credentials on sites that expose a public CMB2 form writing a textarea_code field.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Jtsternberg Wordpress-extensions

Products

Cmb2 Cmb2

CVE-2026-85492

All in One SEO <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathname

The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via URL Pathname in all versions up to, and including, 5.0.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user visits a crafted URL. Exploitation requires the victim to hold the aioseo_manage_seo capability and to open the SEO Preview panel in the WordPress admin toolbar while visiting a page with a malicious payload embedded in the URL pathname.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Smub Wordpress-extensions

Products

All In One Seo All In One Seo

CVE-2026-97652

WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key in all versions up to, and including, 14.16.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Veronalabs Wordpress-extensions

Products

Wp Statistics Wp Statistics

CVE-2026-94405

WordPress Download Manager plugin <= 3.3.71 - Sensitive Data Exposure vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Shahjada Download Manager allows Retrieve Embedded Sensitive Data. This issue affects Download Manager: from n/a through 3.3.71.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Shahjada Wordpress-extensions

Products

Download Manager Download Manager

CVE-2026-94180

WordPress Advanced Ads plugin <= 2.0.26 - Sensitive Data Exposure vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Monetizemore Advanced Ads allows Retrieve Embedded Sensitive Data. This issue affects Advanced Ads: from n/a through 2.0.26.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Monetizemore Wordpress-extensions

Products

Advanced Ads Advanced Ads

CVE-2026-104403

WordPress LearnPress plugin <= 4.4.9 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects LearnPress: from n/a through 4.4.9.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Thimpress Wordpress-extensions

Products

Learnpress Learnpress

CVE-2026-96288

Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory)

Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Thrift

CVE-2026-82458

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Container element count not bounded by the bytes available

Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Apache Redhat

Products

Thrift Hummingbird

CVE-2026-85086

Apache Thrift: Perl TLS client disables certificate verification by default

Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Apache Redhat

Products

Thrift Hummingbird