CVE-2026-82126

The Schema & Structured Data for WP & AMP WordPress plugin (versions 1.63-1.65 ) is vulnerable to improper access control. The plugin fails to verify if a user has permission to edit a specific post when requesting schema generation. This allows users with the contributor role and above to obtain...

EUVD-2026-80188

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not correctly verify the ownership or the moderation status of a comment before returning its content, allowing unauthenticated users to read the content of comments still awaiting moderation or marked as spam...

EUVD-2026-80185

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-78472

The Ni WooCommerce Sales Report WordPress plugin (versions before 4.2.0 ) is vulnerable to an unauthenticated SQL injection attack. The root cause is the failure to properly sanitize and escape a parameter—specifically the 'sort' parameter —before incorporating it into a SQL statement. This flaw ...

EUVD-2026-80186

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any authentication or authorisation checks on one of its report-printing routines, allowing unauthenticated users to retrieve WooCommerce order details and customer contact information, to target an individual order, and ...

CVE-2026-78474

The Ni WooCommerce Sales Report WordPress plugin (versions before 4.2.0 ) is vulnerable to unauthenticated data disclosure. The root cause is a lack of authentication or authorisation checks on one of its report-printing routines, specifically involving the 'btn_print' parameter. This allows unau...

CVE-2026-82125 Schema & Structured Data for WP & AMP 1.46 - 1.65 - Unauthenticated Non-Public Comment Content Disclosure via IDOR

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not correctly verify the ownership or the moderation status of a comment before returning its content, allowing unauthenticated users to read the content of comments still awaiting moderation or marked as spam...

CVE-2026-78474 Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated Order and Customer Data Disclosure via 'btn_print' Parameter

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any authentication or authorisation checks on one of its report-printing routines, allowing unauthenticated users to retrieve WooCommerce order details and customer contact information, to target an individual order, and ...

CVE-2026-76556

The WP Import Export Lite WordPress plugin, in versions prior to 3.9.33 , is vulnerable to SQL injection due to the improper sanitization and escaping of certain export filter values before they are utilized in SQL statements. This flaw allows authenticated users with export permissions—which inc...

CVE-2026-76558

The WP Import Export Lite WordPress plugin versions before 3.9.33 is vulnerable to a Stored DOM XSS vulnerability. The issue stems from the failure to escape custom field names retrieved from the database before they are inserted into the DOM of an administration screen. This allows users with a ...

EUVD-2026-80182

The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the...

CVE-2026-77702 Eventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_token

The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge...

CVE-2026-76557

The WP Import Export Lite WordPress plugin versions prior to 3.9.33 is vulnerable to an authenticated SQL injection attack. The root cause is the insufficient sanitization and escaping of certain import configuration values before they are utilized in SQL statements. This flaw allows users, who h...

CVE-2026-76555 WP Import Export Lite < 3.9.33 - Authenticated Sensitive File Disclosure via Existing File Import Path Traversal

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allowing any user whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import...

EUVD-2026-80179

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allowing any user whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import...

EUVD-2026-80181

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission ...

CVE-2026-76557 WP Import Export Lite < 3.9.33 - Authenticated SQLi via Import Options

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission ...

EUVD-2026-80180

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission, which administrators have by default and may also grant to lower roles, to perform SQL...

CVE-2026-76556 WP Import Export Lite < 3.9.33 - Authenticated SQLi via Export Filter Rules

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission, which administrators have by default and may also grant to lower roles, to perform SQL...

CVE-2026-77702

The Eventin WordPress plugin (also known as WP Event Solution ) versions prior to 4.1.24 is vulnerable to an unauthenticated ticket price rewrite. The flaw exists because the plugin fails to prevent a guest's checkout token from being used to modify order tickets post-checkout. This allows an una...