| CVE/PSC | Application | Date | Affected versions | Description |
|---|---|---|---|---|
| Actual on: Nov 07, 2026, 02:11:41 | ||||
|
CatFolders – WP Media Folders
vulnerable
|
Nov 07, 2026, 02:11:57 |
Min -
Max 2.5.7
|
The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query, allowing authenticated users with upload capability (Author and above) to perform SQL injection attacks. | |
|
CatFolders – WP Media Folders
vulnerable
|
Nov 07, 2026, 02:11:57 |
Min -
Max 2.5.7
|
The CatFolders WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFolders WordPress plugin before 2.5.7's user restriction setting. | |
|
CTX Feed – WooCommerce Product Feed Manager Plugin
vulnerable
|
Nov 07, 2026, 02:11:34 |
Min -
Max 8.0.27
|
The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 8.0.26. This is due to insufficient sanitization of the `feedConfigCustom2` parameter — only `wp_unslash()` is applied before the value is stored verbatim via `update_option()`, and during feed generation the `Custom2Template::evaluate_return()` method passes the stored `{(return ...)}` template expressions directly t... | |
|
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce
vulnerable
|
Nov 07, 2026, 02:11:28 |
Min 3.4.0
Max 3.4.2
|
The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages, and to convert them into events. | |
|
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce
vulnerable
|
Nov 07, 2026, 02:11:28 |
Min -
Max 3.4.2
|
The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to reassign the authorship of arbitrary posts to themselves and to force them to be published. This results in content takeover and in the public disclosure of otherwise private or draft content, and requires the relevant frontend feature to be enabled. | |
|
vulnerable
|
Nov 07, 2026, 01:11:39 |
Min -
Max 1.5.16
|
The VOD Infomaniak plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.15. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to initiate unauthorized video imports using the site owner's Infomaniak API credentials, consume the site owner's VOD account quota, and insert arbitrary rows into the wp_vod_upload table causing pu... | |
|
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
vulnerable
|
Nov 07, 2026, 01:11:30 |
Min -
Max 5.2.14
|
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'item_title (parsed from feed <item><title>)' parameter in all versions up to, and including, 5.2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administ... | |
|
AMP for WP – Accelerated Mobile Pages
vulnerable
|
Nov 07, 2026, 00:11:52 |
Min -
Max 1.1.19
|
The The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.1.18. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with custom-level access and above, to execute arbitrary shortcodes. The vulnerable output block is gated by the 'ampforwp-cat-description' setting, which is enabled b... | |
|
vulnerable
|
Nov 07, 2026, 00:11:33 |
Min 4.4.3
Max 5.3.5
|
The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleting it, allowing a self-registered customer-level user to delete other users' media library attachments, including those owned by administrators. | |
|
Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease!
vulnerable
|
Nov 07, 2026, 00:11:32 |
Min -
Max 3.6.3
|
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.6.2 via the get_entry due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to view, read, and permanently delete forms and entries belonging to any other user — including personally identifiable information submitted throug... | |