🚨 CVE-2026-13252
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'aspectRatio' Attribute in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
🎖@cveNotify
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'aspectRatio' Attribute in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
🎖@cveNotify
🚨 CVE-2026-9188
The Appointment Bookings for Zoom GoogleMeet and more – Wappointment plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 2.7.6 via the `appointmentkey` parameter due to the appointment `edit_key` — the sole authorization token consumed by `tryCancel()` — being generated as a predictable, unsalted MD5 hash of only `client_id` (a sequential integer), `start_at` (a publicly observable appointment timestamp), and `staff_id` (a small enumerable integer), with no secret salt or random component, and the unauthenticated cancellation and rescheduling REST endpoints performing no ownership or identity verification beyond matching this reconstructible key. This makes it possible for unauthenticated attackers to compute valid `edit_key` values for appointments belonging to other users and cancel or reschedule those appointments arbitrarily. Exploitation requires the `allow_cancellation` or `allow_rescheduling` setting to be enabled on the site, both of which are common configurations for active booking deployments; an attacker can obtain the inputs needed to reconstruct a victim's key by booking their own appointment to observe their sequential `client_id` and correlating publicly visible appointment times and enumerable staff identifiers.
🎖@cveNotify
The Appointment Bookings for Zoom GoogleMeet and more – Wappointment plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 2.7.6 via the `appointmentkey` parameter due to the appointment `edit_key` — the sole authorization token consumed by `tryCancel()` — being generated as a predictable, unsalted MD5 hash of only `client_id` (a sequential integer), `start_at` (a publicly observable appointment timestamp), and `staff_id` (a small enumerable integer), with no secret salt or random component, and the unauthenticated cancellation and rescheduling REST endpoints performing no ownership or identity verification beyond matching this reconstructible key. This makes it possible for unauthenticated attackers to compute valid `edit_key` values for appointments belonging to other users and cancel or reschedule those appointments arbitrarily. Exploitation requires the `allow_cancellation` or `allow_rescheduling` setting to be enabled on the site, both of which are common configurations for active booking deployments; an attacker can obtain the inputs needed to reconstruct a victim's key by booking their own appointment to observe their sequential `client_id` and correlating publicly visible appointment times and enumerable staff identifiers.
🎖@cveNotify
🚨 CVE-2025-69155
Unauthenticated Cross Site Scripting (XSS) in Fitness Zone WordPress Theme <= 5.7 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Fitness Zone WordPress Theme <= 5.7 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Fitness Zone WordPress Theme Theme
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-27412
Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions.
🎖@cveNotify
Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions.
🎖@cveNotify
Patchstack
Local File Inclusion in WordPress Pearl - Corporate Business Theme
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-57343
Unauthenticated Cross Site Scripting (XSS) in Real Estate 7 <= 3.5.9 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Real Estate 7 <= 3.5.9 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Real Estate 7 Theme
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-57350
Unauthenticated Cross Site Scripting (XSS) in WP Debugging <= 2.12.2 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in WP Debugging <= 2.12.2 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress WP Debugging Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-57356
Unauthenticated Cross Site Scripting (XSS) in MC Woocommerce Wishlist <= 1.9.19 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in MC Woocommerce Wishlist <= 1.9.19 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress MC Woocommerce Wishlist Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-57361
Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.2.5 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.2.5 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Survey Maker Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-57624
Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.
🎖@cveNotify
Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.
🎖@cveNotify
Patchstack
Remote Code Execution (RCE) in WordPress Blocksy Companion Pro Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-57625
Unauthenticated Cross Site Scripting (XSS) in Admin and Site Enhancements (ASE) Pro <= 8.8.5 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Admin and Site Enhancements (ASE) Pro <= 8.8.5 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Admin and Site Enhancements (ASE) Pro Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-57673
Unauthenticated Cross Site Scripting (XSS) in Optimole <= 4.2.7 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Optimole <= 4.2.7 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Optimole Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-57674
Unauthenticated Cross Site Scripting (XSS) in Timetics <= 1.0.58 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Timetics <= 1.0.58 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Timetics Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-57681
Subscriber Server Side Request Forgery (SSRF) in GeoDirectory <= 2.8.161 versions.
🎖@cveNotify
Subscriber Server Side Request Forgery (SSRF) in GeoDirectory <= 2.8.161 versions.
🎖@cveNotify
Patchstack
Server Side Request Forgery (SSRF) in WordPress GeoDirectory Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-57682
Unauthenticated Cross Site Scripting (XSS) in Simple Link Directory <= 15.0.5 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Simple Link Directory <= 15.0.5 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Simple Link Directory Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-57688
Unauthenticated Broken Access Control in POS Entegratör <= 3.7.103 versions.
🎖@cveNotify
Unauthenticated Broken Access Control in POS Entegratör <= 3.7.103 versions.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress POS Entegratör Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-57747
Unauthenticated Cross Site Request Forgery (CSRF) in Booked <= 3.0.0 versions.
🎖@cveNotify
Unauthenticated Cross Site Request Forgery (CSRF) in Booked <= 3.0.0 versions.
🎖@cveNotify
Patchstack
Cross Site Request Forgery (CSRF) in WordPress Booked Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.