WordPress Fluent Support plugin <= 2.3.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Brobicho in WordPress Plugin Fluent Support versions = 2.3.2...

CVE-2026-91025

The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or...

CVE-2026-91073

The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allowing authenticated users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who views a...

CVE-2026-90951

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state...

CVE-2026-84026

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not restrict access to a REST endpoint that returns user records, allowing unauthenticated attackers to read registered users' private contact details...

CVE-2026-81338

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding...

CVE-2026-81339

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform a per-object ownership check when returning a quiz attempt result, allowing any authenticated user with a minimal subscriber role to read other students' quiz grades, pass/fail status and attempt timestamps by...

CVE-2026-16264

The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request, allowing attackers to read any subscriber's personal data and overwrite any subscriber's record...

EUVD-2026-85060

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read...

EUVD-2026-85061

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless ...

CVE-2026-90951 Paid Member Subscriptions < 3.1.0 - Unauthenticated In-Flight Checkout State Deletion via pms_process_payment

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state...

CVE-2026-91025

The Booking Manager WordPress plugin, in versions prior to 2.1.21 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The software fails to verify that requests to modify per-user settings target the requesting user's own account. This flaw allows any authenticated user with subscribe...

CVE-2026-91025 Booking Manager < 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modification via IDOR

The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or...

CVE-2026-91073

The Subscribe Forms WordPress plugin (versions 1.4.1-1.6.2 ) is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape specific form settings before they are outputted on a page. This allows authenticated users with the Author role ...

EUVD-2026-85047

The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, and that construction happens on every wp-admin request for any logged-in user. Any...

WordPress Forminator Forms plugin 1.38.1-1.57.2.0 - Subscriber+ Form Stripe Field Migration vulnerability

Subscriber+ Form Stripe Field Migration vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Forminator versions 1.38.1-1.57.2.0...

WordPress Post Grid Gutenberg Blocks plugin < 5.0.41 - Unauthenticated Custom Field Key Disclosure vulnerability

Unauthenticated Custom Field Key Disclosure vulnerability discovered by Pedro Pinho in WordPress Plugin PostX versions 5.0.41...

CVE-2026-85006 Happy Addons for Elementor < 3.50.0 - Contributor+ Stored XSS via Creative Button Widget

The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute, allowing users with Contributor-level access and above to inject event-handler attributes that execute JavaScript in the browser o...

WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin < 8.9.5 - Subscriber+ Cross-User Favorites Read and Write vulnerability

Subscriber+ Cross-User Favorites Read and Write vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Directorist versions 8.9.5...

EUVD-2026-85039

The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review...