WordPress

Two vulnerabilities in the WP Rocket WordPress plugin allow (1) code-injection via an executable regular-expression error (CVE-2026-97076) and (2) missing authorization that permits incorrect access (CVE-2026-97075). Both are reported fixed at 3.23.5 in source data, but fix availability is inconsistent in the advisory metadata. [Sources: 4791, 32082, 4790, 32092]

Fluent Forms contains a reflected cross-site scripting (XSS) issue where unauthenticated input via {get.*} SmartCodes in Custom HTML fields can inject script; the issue is addressed in 6.2.15. [CVE-2026-101324]

A critical deserialization flaw (CVE-2026-95606, CVSS 9.8) in The Events Calendar WordPress plugin allows unauthenticated attackers to perform PHP object injection. No fixed version has been confirmed at the time of writing.

The Events Calendar WordPress plugin, versions 6.12.0 up to but not including 6.17.5.1, contains a vulnerability that allows unauthenticated attackers to execute arbitrary shortcodes registered on a site via an unauthenticated AJAX action. No fixed version has been confirmed.

Two vulnerabilities affecting FluentForm through version 6.2.14 have been disclosed: an unauthenticated flaw that can remove client-side functionality (CVE-2026-103353) and a stored cross-site scripting issue (CVE-2026-103343). Both are addressed in version 6.2.15.

A stored cross-site scripting vulnerability affects Essential Addons for Elementor through version 6.8.4. The flaw requires low-privileged authentication and user interaction to exploit. No confirmed fixed version is currently available in our fact package.

A missing authorization vulnerability in the Polylang WordPress plugin, affecting versions through 3.8.7, could allow a lower-privileged authenticated user to retrieve embedded sensitive data. The issue is tracked as CVE-2026-39783 and is fixed in version 3.8.8.

Ninja Forms versions up to 3.15.3 contain an unauthenticated Cross-Site Scripting (XSS) vulnerability. The plugin's advisory lists 3.15.5 as a fixed version reference, but no confirmed fix has been verified by PatchBriefing at this time.

Three separate vulnerabilities in the WPForms WordPress plugin let unauthenticated attackers trigger Stripe refunds and subscription cancellations, inject arbitrary shortcodes to read non-public attachment data, and execute reflected XSS on sites with specific form configurations. No vendor fix has been confirmed for any of the three issues at this time.

Four separate vulnerabilities in the Ninja Forms WordPress plugin (up to and including 3.15.4) allow unauthenticated attackers to inject scripts via form submissions or trigger PHP object injection, with no vendor fix confirmed for three of the four issues.

The Events Calendar WordPress plugin is affected by four separate access control issues, including unauthenticated disclosure of unpublished content and contributor-level privilege escalation. No fixed version is confirmed in available records for three of the four CVEs.

A stored cross-site scripting (XSS) vulnerability affects JetElements For Elementor versions up to 2.9.2.2. The vendor has not yet confirmed a fixed version.

A vulnerability in the Really Simple Security WordPress plugin (before version 9.8.3) allows unauthenticated attackers to bloat a plugin option without limit, degrading how the site handles missing-page requests.

Two critical unauthenticated remote code execution vulnerabilities (CVSS 9.8) affect The Events Calendar WordPress plugin. Both rely on crafted comments combined with insecure deserialization paths. No fixed version has been confirmed yet.

Really Simple Security, a WordPress plugin used on roughly 3 million sites, is affected by two separate vulnerabilities (CVE-2026-89080 and CVE-2026-82519) that allow attackers to bypass two-factor authentication enforcement. No fixed version has been confirmed in the available data.

Versions of the Ninja Forms WordPress plugin from 3.14.10 up to but not including 3.15.2 fail to prevent shortcodes embedded in request-derived values from being executed, allowing unauthenticated users to trigger any shortcode registered on the site. No fixed version has been confirmed yet.