Title	CVE ID	CVSS	Vector	Date
Gravity Forms Booking <= 2.7.1 - Authenticated (Subscriber+) Time-Based SQL Injection via 'staff_id'	CVE-2026-2508	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	June 24, 2026
EntreDroppers <= 1.1.2 - Reflected Cross-Site Scripting via PHP_SELF Parameter	CVE-2026-8628	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	June 23, 2026
Image Sizes on Demand <= 1.3 - Reflected Cross-Site Scripting via PHP_SELF Server Variable	CVE-2026-8622	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	June 23, 2026
NS Product icon badge <= 1.2.4 - Reflected Cross-Site Scripting via PHP_SELF	CVE-2026-8707	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	May 26, 2026
Correct Prices <= 1.0 - Reflected Cross-Site Scripting via PHP_SELF Parameter	CVE-2026-8627	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	May 19, 2026
SponsorMe <= 0.5.2 - Reflected Cross-Site Scripting via PHP_SELF Parameter	CVE-2026-8626	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	May 19, 2026
LJ comments import: reloaded <= 0.97.1 - Reflected Cross-Site Scripting via PHP_SELF Parameter	CVE-2026-8624	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	May 19, 2026
Gravity Bookings <= 2.5.9 - Unauthenticated SQL Injection via 'category_id' Parameter	CVE-2026-1719	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	May 5, 2026
Comment Genius <= 1.2.5 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']	CVE-2026-1647	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	March 20, 2026
[CR]Paid Link Manager <= 0.5 - Reflected Cross-Site Scripting	CVE-2026-1780	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	March 17, 2026
Geo Widet <= 1.0 - Reflected Cross-Site Scripting	CVE-2026-1792	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	February 13, 2026
Address Bar Ads <= 1.0.0 - Reflected Cross-Site Scripting	CVE-2026-1795	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	February 13, 2026
StyleBidet <= 1.0.0 - Reflected Cross-Site Scripting	CVE-2026-1796	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	February 13, 2026
personal-authors-category <= 0.3 - Reflected Cross-Site Scripting	CVE-2026-1754	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	February 13, 2026
Subitem AL Slider <= 1.0.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']	CVE-2026-1634	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	February 6, 2026
MP-Ukagaka <= 1.5.2 - Reflected Cross-Site Scripting	CVE-2026-1643	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	February 6, 2026
Peter's Date Countdown <= 2.0.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']	CVE-2026-1654	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	February 4, 2026
Vzaar Media Management <= 1.2 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']	CVE-2026-1391	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	January 27, 2026
Simple Archive Generator <= 5.2 - Reflected Cross-Site Scripting	CVE-2025-68880	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	January 27, 2026
JustClick registration plugin <= 0.1 - Reflected Cross-Site Scripting via PHP_SELF	CVE-2025-13676	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	January 23, 2026

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation