EUVD-2026-64210

The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the stored...

EUVD-2026-64211

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an...

EUVD-2026-64209

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an...

CVE-2026-19222

CVE-2026-19222 is an authenticated privilege escalation vulnerability in the Forminator Forms WordPress plugin, affecting versions prior to 1.57.0.7 . The plugin does not consistently enforce the role restriction it applies to registration forms. A user with permission to build forms can configur...

CVE-2026-77000

The WP Social Media Login WordPress plugin (through 1.0.6 ) fails to verify that a social login was actually completed with the identity provider before authenticating a visitor. This allows unauthenticated attackers to log in as any existing user, including administrators , simply by supplying t...

CVE-2026-77002

The SmilePass Selfie Login WordPress plugin through 1.0.2 lacks any server-side verification of the identity it is asked to authenticate. This allows unauthenticated users to log in as any registered account, including administrators , effectively granting full site takeover without credentials. ...

CVE-2026-77001

The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin (through version 1.2.0 ) contains an unauthenticated authentication bypass due to missing authentication, authorisation, and nonce checks in a publicly accessible login handler. An unauthenticated attacker can obtain a...

CVE-2026-76793

The Firebase Authentication WordPress plugin before 1.7.1 contains an authentication bypass that allows unauthenticated account takeover . The plugin fails to verify whether the email address in a Firebase authentication token has been confirmed before matching it to a WordPress account and issui...

CVE-2026-76789

CVE-2026-76789 is an unauthenticated stored XSS in the Slider Hero with Video Background, Animation WordPress plugin, affecting versions before 9.1.3 . Two request handlers (identified as Slider Type Change and Add-Slider handlers) lack authorisation and nonce checks, and a stored setting is outp...

CVE-2026-19221

CVE-2026-19221 affects the Forminator Forms WordPress plugin in versions before 1.57.0.5 . The vulnerability stems from a network-wide setting—specifically the Hub Connector API Key —that is not properly restricted to network administrators. On a WordPress multisite network, this allows an admini...

CVE-2026-16612

FiboSearch WordPress plugin versions before 1.34.1 contain an information disclosure vulnerability in two unauthenticated AJAX endpoints: the autocomplete search endpoint (dgwt_wcas_ajax_search) and the Details Panel endpoint (dgwt_wcas_result_details) when queried for taxonomy details. The root ...

CVE-2026-16738

The Conekta Payment Gateway WordPress plugin, versions prior to 6.2.2 , fails to verify the authenticity of incoming payment gateway webhook notifications and does not bind the confirmed payment to the targeted order or validate its amount. This allows unauthenticated attackers to mark arbitrary ...

CVE-2026-19093

Tutor LMS WordPress plugin versions before 4.0.6 contain an arbitrary file read vulnerability in the media streaming function. A stored file path (specifically the video path) is not validated before being used to stream media, allowing users with the instructor role to read arbitrary files on th...

CVE-2026-18052

ManageWP Worker WordPress plugin versions before 4.9.37 contain an authentication bypass vulnerability. The plugin's auto-login mechanism does not bind the target account to the cryptographic signature that authorises the login, and does not prevent replay of an already-used login link. An attack...

CVE-2026-16260

CVE-2026-16260 is a stored cross-site scripting (XSS) vulnerability in the Post Grid, Slider & Carousel Ultimate WordPress plugin, affecting versions before 1.8.1 . The root cause is the failure to sanitise and escape the Header Title field (a custom post type setting) before outputting it in an ...

CVE-2026-14187

Tutor LMS WordPress plugin versions before 4.0.6 are affected by an IDOR (Insecure Direct Object Reference) vulnerability. The plugin fails to enforce per-object ownership checks on its course content type, meaning any user holding the instructor role can read the content of private courses belon...

CVE-2026-76074

AutomatorWP – Automator (WordPress plugin) is vulnerable to an authorization bypass in all versions up to and including 5.8.4 . The automatorwp_campaign_monitor_get_lists AJAX action does not properly verify that the requesting user holds the plugin's manager capability. Because the required nonc...

CVE-2026-76057

The AutomatorWP – Automator WordPress plugin (no-code automations, webhooks & custom integrations) is vulnerable to authorization bypass in all versions up to and including 5.8.4 . The root cause is a missing authorization check on the automatorwp_convertkit_get_forms AJAX action: the required no...

CVE-2026-75027

The Themify Builder plugin for WordPress (all versions up to and including 7.8.0 ) is vulnerable to authorization bypass via the tb_update_old_data AJAX action. The plugin fails to properly verify user authorization, and the required nonce is automatically emitted to all frontend pages rendered b...

CVE-2026-19883

The WPeMatico RSS Feed Fetcher WordPress plugin (all versions up to and including 2.8.24 ) is vulnerable to privilege escalation due to a missing capability check on the wpematico_import_settings function. An authenticated attacker with subscriber-level access or above can update arbitrary WordPr...