🚨 CVE-2026-81153
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputting them in a gallery page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the gallery, including administrators, even where the unfiltered_html capability is disallowed such as on multisite.
🎖@cveNotify
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputting them in a gallery page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the gallery, including administrators, even where the unfiltered_html capability is disallowed such as on multisite.
🎖@cveNotify
WPScan
Robo Gallery < 5.2.6 - Author+ Stored XSS via Image Overlay Effect Meta
See details on Robo Gallery < 5.2.6 - Author+ Stored XSS via Image Overlay Effect Meta CVE 2026-81153. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-81154
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in one of its gallery layouts, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected gallery, including administrators.
🎖@cveNotify
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in one of its gallery layouts, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected gallery, including administrators.
🎖@cveNotify
WPScan
Robo Gallery < 5.2.6 - Author+ Stored XSS via Image Alt Text
See details on Robo Gallery < 5.2.6 - Author+ Stored XSS via Image Alt Text CVE 2026-81154. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-81155
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputting it on a frontend page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing a gallery, including administrators.
🎖@cveNotify
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputting it on a frontend page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing a gallery, including administrators.
🎖@cveNotify
WPScan
Robo Gallery < 5.2.6 - Author+ Stored XSS via Gallery Search Label
See details on Robo Gallery < 5.2.6 - Author+ Stored XSS via Gallery Search Label CVE 2026-81155. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-81156
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputting them on the gallery edit screen, allowing users with the Contributor role and above to store JavaScript that executes in the context of an administrator who opens the gallery for editing.
🎖@cveNotify
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputting them on the gallery edit screen, allowing users with the Contributor role and above to store JavaScript that executes in the context of an administrator who opens the gallery for editing.
🎖@cveNotify
WPScan
Robo Gallery < 5.2.6 - Contributor+ Stored XSS via Gallery Settings
See details on Robo Gallery < 5.2.6 - Contributor+ Stored XSS via Gallery Settings CVE 2026-81156. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-81420
The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks.
🎖@cveNotify
The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks.
🎖@cveNotify
WPScan
Tcard WP <= 1.8.0 - Unauthenticated SQLi via group_id Parameter
See details on Tcard WP <= 1.8.0 - Unauthenticated SQLi via group_id Parameter CVE 2026-81420. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-84251
The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
🎖@cveNotify
The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
🎖@cveNotify
WPScan
click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Arbitrary Options Update
See details on click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Arbitrary Options Update CVE 2026-84251. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-84252
The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
🎖@cveNotify
The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
🎖@cveNotify
WPScan
click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Arbitrary Options Update
See details on click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Arbitrary Options Update CVE 2026-84252. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-84253
The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
🎖@cveNotify
The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
🎖@cveNotify
WPScan
click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Arbitrary Options Update
See details on click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Arbitrary Options Update CVE 2026-84253. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-84254
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
🎖@cveNotify
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
🎖@cveNotify
WPScan
click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Arbitrary Options Update
See details on click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Arbitrary Options Update CVE 2026-84254. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-84258
The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
🎖@cveNotify
The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
🎖@cveNotify
WPScan
click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Stored XSS via post_notifications
See details on click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Stored XSS via post_notifications CVE 2026-84258. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-84259
The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
🎖@cveNotify
The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
🎖@cveNotify
WPScan
click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications
See details on click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications CVE 2026-84259. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-84260
The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
🎖@cveNotify
The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
🎖@cveNotify
WPScan
click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications
See details on click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications CVE 2026-84260. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-84261
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
🎖@cveNotify
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
🎖@cveNotify
WPScan
click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored XSS via post_notifications
See details on click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored XSS via post_notifications CVE 2026-84261. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-84734
The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress plugin through 1.0 is configured with.
🎖@cveNotify
The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress plugin through 1.0 is configured with.
🎖@cveNotify
WPScan
Mindstien Quick Login <= 1.0 - Unauthenticated Administrator Account Takeover via 'mql_pass' Parameter
See details on Mindstien Quick Login <= 1.0 - Unauthenticated Administrator Account Takeover via 'mql_pass' Parameter CVE 2026-84734. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-84737
The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated attackers to log in as any user whose email address they know, including administrators.
🎖@cveNotify
The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated attackers to log in as any user whose email address they know, including administrators.
🎖@cveNotify
WPScan
Freeton WP <= 1.0.0 - Unauthenticated Account Takeover via 'secod' Parameter
See details on Freeton WP <= 1.0.0 - Unauthenticated Account Takeover via 'secod' Parameter CVE 2026-84737. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-85118
The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site.
🎖@cveNotify
The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site.
🎖@cveNotify
WPScan
AI Content Generator Marketing <= 1.0.0 - Unauthenticated Privilege Escalation via Arbitrary Option Update and Deletion
See details on AI Content Generator Marketing <= 1.0.0 - Unauthenticated Privilege Escalation via Arbitrary Option Update and Deletion CVE 2026-85118. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-85121
The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to create and overwrite arbitrary WordPress options with request data, which can take the site offline and deactivate all of its Insurify WordPress plugin through 1.0.
🎖@cveNotify
The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to create and overwrite arbitrary WordPress options with request data, which can take the site offline and deactivate all of its Insurify WordPress plugin through 1.0.
🎖@cveNotify
WPScan
Insurify <= 1.0 - Unauthenticated Arbitrary Option Creation and Overwrite via saveemailtemplatedesign
See details on Insurify <= 1.0 - Unauthenticated Arbitrary Option Creation and Overwrite via saveemailtemplatedesign CVE 2026-85121. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-85126
The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privileged roles to grant themselves the administrator role or arbitrary capabilities, leading to a full site takeover.
🎖@cveNotify
The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privileged roles to grant themselves the administrator role or arbitrary capabilities, leading to a full site takeover.
🎖@cveNotify
WPScan
Crowdfundly <= 2.2.2 - Crowdfundly Manager+ Privilege Escalation
See details on Crowdfundly <= 2.2.2 - Crowdfundly Manager+ Privilege Escalation CVE 2026-85126. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-86706
The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose which option is written, allowing unauthenticated users to alter arbitrary site settings and to make the site unavailable.
🎖@cveNotify
The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose which option is written, allowing unauthenticated users to alter arbitrary site settings and to make the site unavailable.
🎖@cveNotify
WPScan
Quick quotes <= 1.0.0 - Unauthenticated Integer-Value Option Update
See details on Quick quotes <= 1.0.0 - Unauthenticated Integer-Value Option Update CVE 2026-86706. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-86717
The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role.
🎖@cveNotify
The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role.
🎖@cveNotify
WPScan
Insurify <= 1.0 - Unauthenticated Arbitrary Option Deletion via removeimg_popup
See details on Insurify <= 1.0 - Unauthenticated Arbitrary Option Deletion via removeimg_popup CVE 2026-86717. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-86798
The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST endpoints, and does not escape the values stored through them before outputting them in a public page, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of anyone visiting that page, including administrators.
🎖@cveNotify
The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST endpoints, and does not escape the values stored through them before outputting them in a public page, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of anyone visiting that page, including administrators.
🎖@cveNotify
WPScan
HootBoard <= 3.1.4 - Unauthenticated Stored XSS via Board Configuration REST Endpoint
See details on HootBoard <= 3.1.4 - Unauthenticated Stored XSS via Board Configuration REST Endpoint CVE 2026-86798. View the latest Plugin Vulnerabilities on WPScan.