#Plugin Vulnerability
All CosmicBytez Labs articles tagged #Plugin Vulnerability, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-107657: HivePress Directory Plugin Unauthenticated Stored XSS
An unauthenticated stored XSS in HivePress's custom profile attributes lets attackers inject scripts that fire on every visitor to an affected page.
- Security
CVE-2026-103889: Unauthenticated RCE in 3D Product Configurator for WooCommerce
An unauthenticated attacker can POST a malicious xpv_image payload to the WooCommerce 3D Product Configurator plugin for RCE (CVSS 9.8).
- Security
CVE-2026-103355: Unlimited Elements For Elementor Blind SQL Injection
A critical, unauthenticated blind SQL injection in the Unlimited Elements For Elementor WordPress plugin (≤ 2.0.20) exposes site databases.
- Security
CVE-2026-92536: ProfilePress WordPress Plugin Exposes User Data via Shortcode Injection
ProfilePress WordPress plugin versions ≤4.17.4 leak user emails, usernames, and registration dates via shortcode injection (CVSS 8.8). Patch to 4.17.5 now.
- Security
CVE-2026-92977: Unauthenticated Stored XSS in Real Cookie Banner WordPress Plugin
Real Cookie Banner ≤5.3.5 lets unauthenticated attackers plant stored XSS via WordPress comments; CVSS 7.2. Patch to 5.3.6+ now.
- Security
CVE-2026-93428: Ultimate Member Plugin Missing Authorization Exposes Private Profile Fields
Ultimate Member ≤2.13.1 has a missing-authorization flaw letting unauthenticated attackers read privacy-restricted profile fields via directory AJAX endpoint.
- Security
Critical Path Traversal in Super Forms WordPress Plugin Exposes wp-config.php
A CVSS 9.1 unauthenticated path traversal flaw in the Super Forms WordPress plugin (≤ 6.3.316) lets attackers read wp-config.php and other sensitive files.
- Security
CVE-2026-12227: Visual Composer Website Builder Unauthenticated Local File Inclusion
An unauthenticated local file inclusion in Visual Composer's vcv-template parameter lets attackers execute arbitrary PHP on WordPress sites.
- Security
CVE-2026-13355 — Meta Box AIO Unauthenticated Privilege Escalation to Administrator
Chained flaw in Meta Box AIO lets unauthenticated attackers inject a shortcode that grants WordPress Administrator access (CVSS 9.8).
- Security
CVE-2026-19658 — Unauthenticated PHP Object Injection in Give Tributes for WordPress
Give Tributes ≤ 2.3.1 lets unauthenticated attackers inject a PHP object (CVSS 9.8); impact depends on a co-installed POP gadget chain.
- Security
CVE-2026-1255: YS LeadGen WordPress Plugin Leaks Captured Lead Data
An unauthenticated AJAX action in the YS LeadGen plugin exposes all captured form submissions, including PII, to anyone who requests it.
- Security
Photo Gallery WordPress Plugin Flaw Allows Arbitrary File Upload
A loop-counter bug in the Photo Gallery, Sliders, Proofing & Themes plugin lets gallery managers bypass archive extension checks and run code.
- Security
CVE-2026-16310: MemberDash WordPress Plugin Unauthenticated Account Takeover
MemberDash ≤ 1.8.5 has an IDOR letting unauthenticated attackers change any WordPress user's password via a crafted registration request.
- Security
CVE-2026-75865: WPLP Cookie Consent Plugin Unauthenticated File Upload
A critical flaw in the WPLP Cookie Consent WordPress plugin lets unauthenticated attackers upload arbitrary files, opening a path to remote code execution.
- Security
CVE-2026-12949: Critical Account Takeover in WordPress Wishlist Member Plugin
Critical CVSS 9.8 flaw in WordPress Wishlist Member plugin allows unauthenticated account takeover in versions up to 3.34.1.
- Security
CVE-2026-18961: WordPress VentraConnect Plugin Authentication Bypass
High-severity auth bypass in the VentraConnect Social Login plugin allows unauthenticated attackers to take over any WordPress account.
- Security
CVE-2026-14206: HT Contact Form WordPress Plugin Exposes Visitor PII to Unauthenticated Attackers
The HT Contact Form plugin before 2.9.3 allows any unauthenticated user to read saved form drafts containing visitor names, emails, and physical addresses...
- Security
CVE-2026-15964: WordPress SSO Plugin Critical Authentication Bypass
The Single Sign On For TNG plugin for WordPress contains a critical authentication bypass (CVSS 9.8) allowing unauthenticated attackers to reset any...
- Security
CVE-2026-16144: Kali Forms WordPress Plugin Remote Code Execution
The Kali Forms Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution (CVSS 8.1) in all versions up to 2.4.20....
- Security
CVE-2026-15397: Missing Authorization in Subscriptions for WooCommerce Plugin
A missing authorization vulnerability in the Subscriptions for WooCommerce plugin allows authenticated users with minimal privileges to perform...
- Security
CVE-2026-16610: Critical RCE in WordPress Admin & Site Enhancements Pro Plugin
A CVSS 9.8 unauthenticated remote code execution vulnerability in the Admin and Site Enhancements (ASE) Pro WordPress plugin allows attackers to execute...
- Security
CVE-2026-59527: Critical SQL Injection in MapSVG WordPress Plugin
A CVSS 9.3-rated unauthenticated SQL injection vulnerability in the MapSVG WordPress plugin (versions up to 8.14.0) allows remote attackers to read and...
- Security
GoDAM WordPress Plugin Arbitrary File Upload — CVE-2026-14282
A critical unauthenticated arbitrary file upload vulnerability in the GoDAM WordPress media library plugin allows attackers to upload malicious files and...
- Security
WordPress Helpdesk Plugin Unauthenticated Code Injection — CVE-2026-15011
A critical unauthenticated PHP code injection vulnerability in the Customer Support Ticket System & Helpdesk WordPress plugin allows attackers to execute...
- Security
CVE-2026-14291: WordPress Security Ninja Premium 2FA Authentication Bypass
The Security Ninja Premium WordPress plugin before version 5.290 contains a critical authentication flaw that allows attackers to bypass two-factor...
- Security
CVE-2026-15103: WPFunnels Plugin Privilege Escalation via Unauthenticated REST Endpoint
A high-severity privilege escalation flaw in WPFunnels for WordPress allows attackers to update arbitrary site options via an unvalidated REST callback,...
- Security
CVE-2026-12761: miniOrange WordPress Social Login Auth Bypass Enables Full Admin Takeover
A critical authentication bypass chain in the miniOrange Social Login and Register WordPress plugin allows unauthenticated attackers to crack a trivially...
- Security
CVE-2026-13353: WordPress WP Ultimate CSV Importer RCE via MappedFields Parameter
A critical CVSS 8.8 remote code execution vulnerability in WP Ultimate CSV Importer allows unauthenticated attackers to execute arbitrary PHP code on...
- Security
CVE-2026-14894: WordPress Super Forms Plugin Critical Arbitrary File Upload
A critical unauthenticated arbitrary file upload vulnerability in the Super Forms plugin for WordPress (CVSS 9.8) allows attackers to upload and execute...
- Security
CVE-2026-15158: WordPress Blocksy Companion Arbitrary File Upload (CVSS 9.8)
A critical arbitrary file upload vulnerability in the Blocksy Companion WordPress plugin (versions up to 2.1.46) allows unauthenticated attackers to...
- Security
CVE-2026-15282: WordPress Instant Appointment Plugin Critical File Upload
A critical unauthenticated arbitrary file upload flaw (CVSS 9.8) in the Instant Appointment WordPress plugin allows attackers to upload and execute...
- Security
CVE-2026-14487: WordPress Simple Coherent Form Plugin — Critical Unauthenticated File Deletion
A critical CVSS 9.1 vulnerability in the Simple Coherent Form WordPress plugin allows unauthenticated attackers to delete arbitrary files on the server,...
- Security
CVE-2026-12923: YouTube Showcase WordPress Plugin Arbitrary Function Call
A high-severity arbitrary function call vulnerability in the YouTube Showcase plugin allows authenticated attackers to invoke arbitrary PHP functions via...
- Security
CVE-2026-9711: Critical SQL Injection in EventON WordPress Plugin (CVSS 9.8)
A critical unauthenticated SQL injection vulnerability in the EventON WordPress Virtual Event Calendar Plugin affects versions up to 5.0.11, exposing...
- Security
CVE-2026-8095: WordPress Frontend File Manager Plugin Allows Arbitrary File Deletion
A high-severity authenticated file deletion vulnerability in the nmedia Frontend File Manager Plugin for WordPress allows subscribers to delete any file...
- Security
CVE-2026-54820: Critical SQL Injection in JetBooking WordPress Plugin
A critical unauthenticated SQL injection vulnerability (CVSS 9.3) in the JetBooking WordPress plugin affects all versions up to 4.0.4.1, potentially...
- Security
CVE-2016-20066: WordPress CP Polls Persistent XSS via File Upload
WordPress CP Polls plugin version 1.0.8 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through...
- Security
CVE-2026-27053: Critical PHP Object Injection in Broadcast Live Video Plugin
A critical unauthenticated PHP Object Injection vulnerability in the Broadcast Live Video WordPress plugin (versions < 7.1.3) carries a CVSS score of 9.8...
- Security
CVE-2026-8935: WP Maps Pro Unauthenticated Admin Account Creation (CVSS 9.8)
A critical unauthenticated vulnerability in the WP Maps Pro WordPress plugin before 6.1.1 allows any visitor to create an administrator account and...
- Security
CVE-2026-7537: MDJM Event Management WordPress Plugin Arbitrary File Upload
A high-severity arbitrary file upload vulnerability in the MDJM Event Management plugin for WordPress allows authenticated attackers to upload malicious files…
- Security
CVE-2026-7654: PHP Object Injection RCE in WordPress Admin Columns Plugin (≤ 7.0.18)
A high-severity PHP Object Injection vulnerability in the Admin Columns WordPress plugin (versions up to 7.0.18) allows authenticated attackers to achieve…
- News
WP Maps Pro Bug Exploited to Create Admin Accounts on WordPress Sites
Hackers are actively exploiting a critical vulnerability in the WP Maps Pro WordPress plugin that allows unauthenticated attackers to create rogue…
- Security
CVE-2026-7459: WordPress Simple History Plugin Account Takeover
A broken authentication check in the Simple History WordPress plugin (versions up to 5.26.0) allows Subscriber-level users to take over any WordPress...
- Security
CVE-2026-9757: GEO my WP Plugin SQL Injection via Query String Bypass
The GEO my WP WordPress plugin (versions up to 4.5.5) is vulnerable to unauthenticated SQL injection via the swlatlng and nelatlng parameters, which...
- Security
WP ERP Pro SQL Injection via search_key Parameter
A CVSS 7.5 SQL injection vulnerability in the WP ERP Pro WordPress plugin (all versions up to 1.5.1) allows unauthenticated attackers to extract sensitive...
- Security
CVE-2026-8719: WordPress AI Engine Plugin Privilege
A missing WordPress capability check in the AI Engine plugin's MCP OAuth bearer-token path allows any authenticated user to escalate privileges to...
- Security
CVE-2026-2993: SQL Injection in AIWU AI Chatbot WordPress
A high-severity SQL injection vulnerability (CVE-2026-2993) in the AI Chatbot & Workflow Automation by AIWU WordPress plugin allows unauthenticated...
- Security
CVE-2026-4882: Unauthenticated File Upload in WordPress
A critical unauthenticated arbitrary file upload vulnerability in the User Registration Advanced Fields plugin for WordPress allows attackers to upload...
- Security
CVE-2026-7458: Authentication Bypass via OTP Flaw in WordPress User Verification Plugin
A critical authentication bypass in the User Verification by PickPlugins plugin for WordPress allows unauthenticated attackers to bypass OTP verification...
- Security
Critical Authentication Bypass in WordPress Temporary Login
A critical CVSS 9.8 authentication bypass in the WordPress Temporary Login plugin (versions up to 1.0.0) allows unauthenticated attackers to gain...
- Security
CVE-2026-39440: FunnelFormsPro WordPress Plugin Remote Code
A critical code injection vulnerability in the FunnelFormsPro WordPress plugin through version 3.8.1 allows remote code inclusion, enabling attackers to...
- Security
CVE-2026-3844 — Breeze Cache WordPress Plugin
A critical unauthenticated file upload vulnerability in the Breeze Cache WordPress plugin allows attackers to upload arbitrary files to affected servers...