CVEs published by WPScan

CVEs published by WPScan (CVE Numbering Authority). 40 tracked.

CVE-2026-97353 HIGH n/a The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership chec
CVE-2026-97352 HIGH n/a The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of
CVE-2026-87835 HIGH n/a The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may s
CVE-2026-114429 HIGH n/a The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content
CVE-2026-113674 HIGH n/a The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by
CVE-2026-113673 HIGH n/a The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before w
CVE-2026-113493 HIGH n/a The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attri
CVE-2026-113492 HIGH n/a The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when l
CVE-2026-113491 HIGH n/a The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it
CVE-2026-113490 HIGH n/a The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when renderin
CVE-2026-113489 HIGH n/a The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the
CVE-2026-112207 HIGH n/a The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to t
CVE-2026-110956 HIGH n/a The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor b
CVE-2026-107907 HIGH n/a The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling
CVE-2026-107887 HIGH n/a The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on
CVE-2026-105199 HIGH n/a The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in on
CVE-2026-17032 CRITICAL 9.8 Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update se
CVE-2026-14237 HIGH 7.2 The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target
CVE-2026-94267 CRITICAL 9.0 The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO Wor
CVE-2026-94268 HIGH 8.1 The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO Wor
CVE-2026-94262 HIGH 8.1 The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO Wor
CVE-2026-109936 HIGH 7.5 The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dyna
CVE-2026-113499 HIGH 7.5 The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to styl
CVE-2026-113500 HIGH 7.5 The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to styl
CVE-2026-111982 HIGH 7.2 The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the
CVE-2026-109933 MEDIUM 6.8 The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styl
CVE-2026-111966 MEDIUM 6.8 The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attr
CVE-2026-94264 MEDIUM 6.8 The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO Wor
CVE-2026-109934 MEDIUM 5.3 The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readab
CVE-2026-94263 MEDIUM 4.8 The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 t
CVE-2026-111738 MEDIUM 5.5 The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level privilege before applying an
CVE-2026-113472 MEDIUM 5.4 The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files
CVE-2026-112219 MEDIUM 4.9 The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of files
CVE-2026-112230 LOW 3.7 The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup c
CVE-2026-111965 MEDIUM 4.3 The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all co
CVE-2026-110537 LOW 3.8 The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may ma
CVE-2026-111737 LOW 3.5 The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before out
CVE-2026-110510 LOW 3.5 The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of so
CVE-2026-113501 LOW 3.1 The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dism
CVE-2026-109935 HIGH n/a The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a publis

← Back to latest CVEs