CVE-2026-13245 affects MaxButtons through version 9.8.5 and allows an unauthenticated attacker to inject an event handler into the admin list screen through the view query parameter. An administrator who opens a crafted URL and activates the injected access key can run JavaScript within their wp-admin session. This can expose administrative data or allow actions available to the victim account. The issue is fixed in version 9.8.6.
CVE-2025-15665 affects the Ultimate Before After Image Slider & Gallery (BEAF) plugin and is an authenticated Admin+ Stored Cross-Site Scripting vulnerability in versions below 4.7.1. The BEAF Slider widget stores its Enter Shortcode value and passes it to do_shortcode() without escaping non-shortcode content, so an administrator or another trusted widget manager can persist markup that executes in the browser of any visitor who loads a page containing the widget. If an administrator views the affected page, the script runs in that authenticated origin and can become an account takeover path. The issue is fixed in version 4.7.1.
CVE-2026-2381 affects WooCommerce Stripe Payment Gateway and allows unauthenticated attackers to change pending orders to Failed through the public wc_stripe_pay_for_order endpoint. The handler accepts a supplied order ID without checking order ownership or an order key. A request with a fake payment method can trigger a payment error that changes the selected order status. Versions through 10.7.0 are affected, with a fix in 10.8.0.
CVE-2025-15693: an Admin+ Path Traversal in the JCH Optimize WordPress plugin (4.2.1–5.0.0), reachable through the dir parameter of the filetree AJAX action. Details, timeline, PoC and remediation.
CVE-2025-15694: an Admin+ Stored XSS in the Joli Table Of Contents WordPress plugin (2.0.0–2.8.0), triggered through the headings_overflow setting on the plugin’s General tab. Details, timeline, PoC and remediation.
CVE-2026-9134 affects FooGallery and is an authenticated Contributor+ Stored Cross-Site Scripting vulnerability in versions up to and including 3.1.31. A crafted custom_attribute_key shortcode parameter can create an onmouseenter handler on the gallery container, causing persistent JavaScript to run when a visitor moves the pointer over the gallery. The issue is fixed in version 3.1.32.
CVE-2025-15663: an Author+ Stored XSS in the BEAF (Ultimate Before After Image Slider & Gallery) WordPress plugin below 4.7.19, triggered through the slider’s After Label field. Details, timeline, PoC and remediation.
CVE-2026-9125 affects Presto Player and is an authenticated Contributor+ Stored Cross-Site Scripting vulnerability in versions up to and including 4.2.0. A malicious presto_player_overlay shortcode can preserve a javascript: URI in link_url, allowing attacker-controlled JavaScript to run in the WordPress origin when another user clicks the overlay during playback.
CVE-2026-7526 affects PDF Embedder <= 4.9.3 and exposes site-wide plugin settings to authenticated Contributor+ users through the global pdfembPluginOptions JavaScript object. A saved premium license key can also be disclosed when the premium add-on is installed.
CVE-2026-3985 affects Creative Mail <= 1.6.9 with unauthenticated time-based SQL injection in the abandoned checkout flow. A crafted checkout UUID reaches an unprepared SQL query and can be used to infer sensitive database data.