A stored Cross-Site Scripting (XSS) vulnerability exists in the PowerPress Podcasting plugin by Blubrry for WordPress versions before 11.17.2. This flaw allows users with contributor role or higher to inject malicious scripts via unsanitized block attributes, which are then output on pages. The vulnerability has a CVSS score of 6.8, indicating medium severity.
CVE-2026-97227 is a vulnerability in the NextScripts: Social Networks Auto-Poster WordPress plugin versions before 4.4.8. The plugin fails to perform proper capability or ownership checks on several AJAX actions, relying solely on a nonce for authorization. This flaw allows users with posting feature access granted by an administrator to export social account credentials, delete arbitrary posts, and reset the plugin's configuration.
A stored Cross-Site Scripting (XSS) vulnerability exists in the Optima Express IDX WordPress plugin versions 8.6.0 up to but not including 8.7.6. This flaw allows users with author-level privileges to inject malicious scripts via a REST endpoint, which are then stored and rendered in the document head when posts are viewed.
CVE-2026-96897 is a vulnerability in the Optima Express IDX WordPress plugin versions 8.5.0 up to but not including 8.7.6. The plugin fails to perform authorization checks on a specific AJAX action accessible to unauthenticated users. This flaw allows attackers to create an author-role account with a fixed username and repeatedly rotate its application password on any affected installation.
CVE-2026-96896 is a high-severity vulnerability in the Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin versions before 19.9.7. The plugin fails to perform an authorization check on one of its AJAX actions, allowing users with subsite administrator roles on a multisite network to write and delete arbitrary files in the shared filesystem. This can lead to remote code execution.
CVE-2026-96895 is a stored Cross-Site Scripting (XSS) vulnerability in the WP YouTube Lyte WordPress plugin versions before 1.7.31. It occurs because some attributes of YouTube embed blocks are not properly escaped before being output in HTML attributes during block rendering. This flaw allows users with contributor-level roles to inject malicious scripts that persist in the application.
CVE-2026-92995 is a medium severity vulnerability in the Verge3D Publishing and E-Commerce WordPress plugin up to version 4.13.0. It allows unauthenticated users to download digital goods files attached to any order without authorization due to insufficient access restrictions on a file-download handler.
A vulnerability in the Mailchimp for WooCommerce WordPress plugin before version 6.3 allows unauthenticated attackers to access saved cart contents of customers by using a request-supplied identifier derived from the customer's email address. This flaw does not require authentication or ownership verification, enabling attackers to confirm if a customer shops at the store and read their saved cart data.
WPeMatico RSS Feed Fetcher WordPress plugin versions before 2.8.27 do not sanitize imported RSS feed content before storing it as post content. This allows users with Contributor role or higher to inject stored Cross-Site Scripting (XSS) payloads. The vulnerability is identified as CWE-79 and has a CVSS score of 6.8, indicating a medium severity risk. Exploitation requires user interaction and privileges at least at the Contributor level.
CVE-2026-89003 is a Server-Side Request Forgery (SSRF) vulnerability in the WPeMatico RSS Feed Fetcher WordPress plugin versions before 2.8.27. It allows users with contributor-level access or higher to make the server send requests to internal-only hosts and read the responses without proper capability checks.
CVE-2026-89001 is a vulnerability in the WPeMatico RSS Feed Fetcher WordPress plugin prior to version 2.8.27. It allows users with contributor-level access or higher to publish posts live and assign any registered user, including administrators, as the post author without proper permission checks. This improper privilege management can lead to unauthorized content publication and misattribution of posts.
CVE-2026-89000 is a server-side request forgery (SSRF) vulnerability in the WPeMatico RSS Feed Fetcher WordPress plugin versions before 2.8.27. The plugin does not validate or restrict the destination of user-supplied feed URLs and lacks capability checks, allowing users with contributor-level access or higher to make the server fetch internal-only resources and read the responses.
The Online Scheduling and Appointment Booking System WordPress plugin before version 28.3 contains a vulnerability that allows users with a custom booking-management capability to perform deserialization of untrusted data. This flaw enables injection of arbitrary PHP objects, overwriting of privileged site options, and reading of stored integration secrets. The vulnerability arises because the plugin does not restrict a privileged maintenance feature exclusively to administrators and fails to prevent unsafe deserialization. The issue affects versions from 23.2 up to but not including 28.3.
The Online Scheduling and Appointment Booking System WordPress plugin before version 28.3 contains an authorization bypass vulnerability. Authenticated users with staff-level privileges can access, modify, or delete appointment and payment records of other staff members without proper verification. This includes access to associated customer personal information. The vulnerability arises because the plugin does not verify that the requested records belong to the requesting staff member in its staff-role AJAX actions.
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Download Manager WordPress plugin Pro edition before version 7.5.6. The flaw arises because the plugin does not properly sanitise and escape data submitted via its email-locked download subscription form before displaying it on an admin page. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute in the context of administrator users. The free edition of the plugin is not affected as it lacks the vulnerable feature.
EmbedPress WordPress plugin versions before 4.6.7 contain a stored cross-site scripting (XSS) vulnerability. This flaw arises because one of the plugin's block attributes is not properly escaped before being output inside an HTML attribute. Users with contributor role or higher privileges can exploit this to execute malicious scripts that affect higher privileged users viewing the post.
CVE-2026-82841 is an information exposure vulnerability in the UpdraftPlus: WP Backup & Migration Plugin for WordPress. Versions from 1.23.8 up to but not including 1.26.8, and from 2.23.8 up to but not including 2.26.8.26, do not perform capability checks in a routine that outputs stored remote storage settings on admin pages after a specific post-migration state. This flaw allows any authenticated user, including low-privilege roles like subscribers, to access sensitive credentials such as passwords and secret keys for backup destinations.
CVE-2026-81655 is a high-severity vulnerability in the Ad Inserter WordPress plugin versions 2.8.12 through 2.8.18. It allows users with as low a privilege as subscriber to access a settings page and inject code that can be executed as PHP or served unescaped to visitors. This occurs due to improper access control and lack of content filtering on the affected settings page.
CVE-2026-84069 is a medium severity vulnerability in the WebFacing™ WordPress plugin versions 5.3 up to but not including 5.4. It involves improper limitation of a pathname to a restricted directory (CWE-22), allowing unauthenticated users to perform Local File Inclusion by exploiting a bundled script that does not validate user-supplied paths.
AzuraCast versions prior to 0.23.4 have a code injection vulnerability in the ConfigWriter::cleanUpString() method. This flaw allows authenticated users with Media or Profile permissions to inject arbitrary Liquidsoap code via unsanitized string interpolation sequences. Exploitation can lead to execution of shell commands as the azuracast user when the station restarts.