wpdevteam vulnerabilities

CVEs per yearBy the year they were published

1. 202312
2. 202457
3. 202514
4. 202632

Newest CVEs

• CVE-2026-112365

  easy.jobs <= 2.8.4 - Unauthenticated Stored Cross-Site Scripting via 'cover_letter' Parameter

  wpdevteam · easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution

  High7.2
• CVE-2026-118205

  Essential Addons for Elementor <= 6.8.7 - Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revision

  wpdevteam · Essential Addons for Elementor – Popular Elementor Templates & Widgets

  High7.4
• CVE-2026-108366

  easy.jobs <= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Block Attribute

  wpdevteam · easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution

  Medium6.4
• CVE-2026-109985

  xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_content' Parameter

  wpdevteam · xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN

  Medium6.4
• CVE-2026-109513

  NotificationX <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route

  wpdevteam · NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar

  High7.2
• CVE-2026-110721

  NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route

  wpdevteam · NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar

  Medium5.3
• CVE-2026-92727

  EmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slidesShow' Block Attribute

  wpdevteam · EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents

  Medium6.4
• CVE-2026-96256

  Gutenberg Essential Blocks <= 6.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker' Attribute

  wpdevteam · Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns

  Medium6.4
• CVE-2026-89330

  EmbedPress <= 4.6.5 - Reflected Cross-Site Scripting via 'hash' and 'unique' Parameters

  wpdevteam · EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents

  Medium6.1
• CVE-2026-75980

  BetterDocs <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content

  wpdevteam · BetterDocs – AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot

  Medium6.4