Threat database

SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpsp_el_editor_form AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or reschedule administrator posts, or publish other users' pending or draft posts.

Incorrect Privilege Assignment vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Privilege Escalation.This issue affects Essential Addons for Elementor: from n/a through 6.8.5.

The WP CV Builder plugin for WordPress has a vulnerability allowing unauthenticated attackers to upload arbitrary PNG files due to missing authorization checks in the 'wp_save_signature_image' function. This affects all versions up to and including 1.3.1. The vulnerability can lead to unauthorized file uploads to the WordPress uploads directory.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 6.8.4.

CVE-2026-81777 is an authentication bypass vulnerability in WPDeveloper Essential Addons for Elementor that allows identity spoofing. It affects versions up to and including 6.8.0. The vulnerability is classified under CWE-290 (Authentication Bypass by Spoofing) and has a medium severity with a CVSS score of 5.3. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.

Contributor Cross Site Scripting (XSS) in Table Of Contents Block <= 1.5.0 versions.

CVE-2026-61961 is a high severity vulnerability in WPDeveloper's EmbedPress plugin, affecting versions up to and including 4.5.6. It is an unauthenticated Cross-Site Scripting (XSS) vulnerability, classified under CWE-79, which involves improper neutralization of input during web page generation. This vulnerability allows attackers to inject malicious scripts that can impact confidentiality, integrity, and availability with user interaction.

Contributor Cross Site Scripting (XSS) in BetterDocs <= 4.6.2 versions.

Improper Validation of Specified Quantity in Input vulnerability in WPDeveloper Better Payment – Instant Payments, Donations, Fundraising with Subscriptions &amp; More better-payment allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Better Payment – Instant Payments, Donations, Fundraising with Subscriptions &amp; More: from n/a through <= 2.2.0.

EmbedPress versions up to and including 4.5.2 contain an unauthenticated sensitive data exposure vulnerability. This issue is due to an authorization bypass through a user-controlled key, classified under CWE-639. The vulnerability allows an attacker to access sensitive data without authentication.

CVE-2026-25440 is a medium severity vulnerability in WPDeveloper's Essential Addons for Elementor plugin versions prior to 6.6.0. It involves unauthenticated broken access control, classified under CWE-862, allowing unauthorized users to perform actions without proper authorization. The vulnerability does not impact confidentiality or availability but can lead to integrity issues. No official patch or remediation guidance is currently confirmed from the vendor. Users should monitor vendor advisories for updates and apply fixes once available.

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPDeveloper BetterDocs betterdocs allows Retrieve Embedded Sensitive Data.This issue affects BetterDocs: from n/a through <= 4.3.10.

Insertion of Sensitive Information Into Sent Data vulnerability in WPDeveloper Templately allows Retrieve Embedded Sensitive Data.This issue affects Templately: from n/a through 3.6.1.

Missing Authorization vulnerability in WPDeveloper NotificationX notificationx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NotificationX: from n/a through <= 3.2.1.

Missing Authorization vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Addons for Elementor: from n/a through <= 6.5.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows DOM-Based XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.5.3.

Missing Authorization vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Addons for Elementor: from n/a through <= 6.2.4.

Insertion of Sensitive Information Into Sent Data vulnerability in WPDeveloper Templately allows Retrieve Embedded Sensitive Data. This issue affects Templately: from n/a through 3.2.7.