CVE Vulnerability Catalog

The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outputting it in an HTML attribute on an administrative page. This allows unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as admin.

The Rank Math SEO WordPress plugin before version 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against. This allows users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged users.

The Rank Math SEO WordPress plugin before version 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit and to overwrite the titles of posts belonging to other users.

The Rank Math SEO WordPress plugin before version 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata. This allows users with the Author role and above to read the title, body, and metadata of other users' non-public posts.

The Rank Math SEO WordPress plugin before version 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata. This allows users with the Author role and above to alter that metadata on content, taxonomy terms, and user profiles they do not own, and to remove other users' content from the site's sitemap and search engine index.

The Rank Math SEO WordPress plugin before version 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable. This allows unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled, and password-protected posts.

The Rank Math SEO WordPress plugin before version 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata. This allows unauthenticated users to read the content of password-protected posts.

The GamiPress WordPress plugin before version 7.9.9.6 does not properly restrict its video watch-tracking functionality. This allows users with a role as low as Subscriber to award the configured gamification points, achievements and ranks to arbitrary users including administrators, and to accrue them without limit.

The MultiVendorX WordPress plugin before version 5.0.15 does not have proper authorisation controls on one of its REST API listing routes. This allows unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications.

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting. Exploitation requires the plugin to be running a non-default icon display configuration.

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before version 3.0.1 does not escape the post title before outputting it in an inline JavaScript event handler. This allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks which are triggered when a visitor interacts with the affected button. Exploitation requires the plugin to be running a non-default icon display configuration.

The Comments WordPress plugin before version 7.6.66 does not validate a value used to build a database query. This allows unauthenticated users to inject SQL and read comments they are not entitled to see, including comments awaiting moderation, comments marked as spam or trashed, and comments on private and draft posts. The injected text reaches the query as grammar rather than as data and does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed comment content rather than the database at large.

The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges. This allows a subscriber-level user to gain administrator access after the site owner restores or migrates the site.

The Ultimate Member WordPress plugin before version 2.13.0 does not check whether a comment has been approved or whether the profile it belongs to is private before returning profile activity to unauthenticated visitors. This allows reading the content of comments still awaiting moderation.

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form. This allows authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead to remote code execution when a suitable gadget chain is present on the site.

The Gutentor WordPress plugin before version 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role.

The Solace Extra WordPress plugin before version 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published (draft, pending, private, and trashed) Site Builder parts that WordPress would otherwise not serve.

The MotoPress Appointment Booking WordPress plugin before version 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an incomplete fix of CVE-2026-9180: the deletion remains reachable on sites using payment confirmation, confirmed through version 2.4.7.

The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce validation in the DPDEV_install_themes_func() function registered on the wp_ajax_DPDEV_install_themes action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install arbitrary theme ZIP packages containing PHP files that are extracted into the web-accessible wp-content/themes/ directory, which may make remote code execution possible.

The Booking for Appointments and Events Calendar WordPress plugin before version 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by enumerating its identifier.