CVE-2026-87959

The WPBot WordPress plugin (versions 8.7.2-8.7.5 ) is vulnerable to improper access control due to a missing capability check on an AJAX action . This flaw allows users with subscriber-level access to overwrite the plugin's Claude AI provider settings , which includes the API key used for outgoin...

EUVD-2026-80212

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI...

CVE-2026-87959 WPBot 8.7.2 - 8.7.5 - Subscriber+ Claude AI Settings Update

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI...

CVE-2026-89327 FluentBoards < 2.0.15 - Board Member+ Comment Author Spoofing via 'comment_by' Parameter

The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is the user the comment is attributed to, allowing any board member to post comments that appear to be authored by another user, including administrators...

CVE-2026-89327

The FluentBoards WordPress plugin (versions before 2.0.15 ) is vulnerable to a comment author spoofing flaw. The application fails to verify that a board member submitting a comment is the same user to whom the comment is attributed. This allows any authenticated board member to post comments app...

EUVD-2026-80211

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category...

CVE-2026-89328

The FluentBoards WordPress plugin, in versions prior to 2.0.15 , contains an improper access control vulnerability. The software fails to properly verify if a user possesses board-manager privileges before executing various board-management operations, incorrectly relying only on board membership...

CVE-2026-88910 KBoard < 6.7 - Unauthenticated Board Media Deletion via IDOR

The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board media, allowing unauthenticated attackers to permanently delete its uploaded media files and their database records by iterating identifiers...

CVE-2026-89328 FluentBoards < 2.0.15 - Board Member+ Board Membership and Public Access Modification

The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges before performing several board-management operations, checking only board membership. This allows any member of a board to carry out manager-only actions on it, including adding or...

EUVD-2026-80213

The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board media, allowing unauthenticated attackers to permanently delete its uploaded media files and their database records by iterating identifiers...

EUVD-2026-80214

The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is the user the comment is attributed to, allowing any board member to post comments that appear to be authored by another user, including administrators...

EUVD-2026-80210

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent staff records, allowing unauthenticated attackers to read staff email addresses, phone numbers, private internal notes and the linked WordPress account nam...

CVE-2026-87896

The Rox Appointment Booking WordPress plugin, in versions prior to 1.2.8 , is vulnerable to unauthenticated staff PII disclosure. The root cause is a lack of authorization checks on the endpoint responsible for returning booking agent (staff) records. This allows unauthenticated attackers to acce...

CVE-2026-86823 Newsletter < 9.3.7 - Unauthenticated Open Redirect and Subscriber Token Disclosure via ncu Parameter

The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthenticated attackers to redirect users to arbitrary external sites and to disclose a subscriber token that grants access to that subscriber...

CVE-2026-86823

The Newsletter WordPress plugin (versions before 9.3.7 ) contains a vulnerability where it fails to validate the destination of a redirect following a public subscription action. This allows unauthenticated attackers to perform an open redirect to arbitrary external sites and disclose a subscribe...

EUVD-2026-80209

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...

CVE-2026-86784

The Visualizer WordPress plugin (versions before 4.0.8 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to sanitise and escape a chart's JSON data source configuration before it is output back in the chart editor. This allows users with Contributor role p...

CVE-2026-87854 Subscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and...

CVE-2026-87828 Seraphinite Accelerator < 2.29.24 - Subscriber+ DoS via seraph_accel_State Update

The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire...

CVE-2026-87860 Subscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRF

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...