| CVE/PSC | Application | Date | Affected versions | Description |
|---|---|---|---|---|
| Actual on: May 20, 2026, 13:05:24 | ||||
|
vulnerable
|
May 20, 2026, 11:05:55 |
Min -
Max 28.1.7
|
The Contest Gallery plugin for WordPress is vulnerable to SQL Injection via the 'form_input' parameter in versions up to, and including, 28.1.6. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query inside the unauthenticated 'post_cg_gallery_form_upload' AJAX action (specifically the 'cb' branch of the included users-upload-check.php, where $f_input_id is concatenated unquoted into 'SELECT Field_Content FROM ... WHERE id = $f_input_... | |
|
vulnerable
|
May 20, 2026, 05:05:39 |
Min -
Max 1.2.1
|
Cookie Law Bar 1.2.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting unsanitized input to the Bar Message field. Attackers can inject script payloads through the plugin settings page that execute in the browsers of all WordPress users viewing the site, enabling cookie theft and sensitive data exfiltration. | |
|
WordPress Infinite Scroll – Ajax Load More
vulnerable
|
May 20, 2026, 04:05:24 |
Min -
Max 7.8.4
|
The Ajax Load More WordPress plugin before 7.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | |
|
vulnerable
|
May 20, 2026, 03:05:22 |
Min -
Max 3.1.9
|
The AI Engine plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.8 via the rest_helpers_create_images function. This makes it possible for authenticated attackers, with Editor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. On Cloud instances, this issue allows for metadata retrieving. | |
|
vulnerable
|
May 20, 2026, 03:05:22 |
Min -
Max 3.5.0
|
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Privilege Escalation in version 3.4.9. This is due to missing WordPress capability enforcement in the MCP OAuth bearer-token authorization path, where any valid OAuth token causes MCP access to be granted without verifying administrator privileges. This makes it possible for authenticated (Subscriber+) attackers to invoke admin-level MCP tools and escalate privileges to Administrator. | |
|
vulnerable
|
May 20, 2026, 03:05:08 |
Min -
Max 4.0.0
|
WP Document Revisions [wp-document-revisions] < 4.0.0 CVE-2026-42677 | |
|
vulnerable
|
May 20, 2026, 01:05:51 |
Min -
Max 9.1.11.001
|
The WP Photo Album Plus WordPress plugin before 9.1.11.001 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. | |
|
The Ultimate Video Player For WordPress – by Presto Player
vulnerable
|
May 19, 2026, 23:05:51 |
Min -
Max 4.1.4
|
Missing Authorization vulnerability in Brainstorm Force Presto Player allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Presto Player: from n/a through 4.1.3. | |
|
vulnerable
|
May 19, 2026, 21:05:10 |
Min -
Max 1.1.2
|
WP Learn Manager 1.1.2 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the fieldtitle parameter. Attackers can submit POST requests to the jslm_fieldordering page with XSS payloads in the fieldtitle field to execute arbitrary JavaScript when administrators view the field ordering interface. | |
|
vulnerable
|
May 19, 2026, 20:05:57 |
Min -
Max 3.1.15
|
The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress plugin before 7.7.9 are vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format. | |