CVE-2026-82519

Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler...

CVE-2026-82519 Really Simple Security < 9.8.2 Authorization Bypass via profile-page update handler

Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler...

CVE-2026-82519

The Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check in the profile-page update handler. An authenticated low-privileged attacker can submit a crafted POST request omitting the two-factor-authentication field, which skips nonce verification and trigg...

WordPress Job Postings plugin <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin Jobs for WordPress versions = 2.8.1...

Attackers Actively Exploiting Critical Vulnerability in WooCommerce Wholesale Lead Capture Plugin

On February 20th, 2026, a critical Unauthenticated Arbitrary File Upload vulnerability was publicly disclosed in WooCommerce Wholesale Lead Capture, a premium WordPress plugin with an estimated 6,000 active installations. This vulnerability can be leveraged by unauthenticated attackers to upload...

CVE-2026-89023 ThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST API

ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stored offer records, delete arbitrary offers by numer...

CVE-2026-89023 ThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST API

ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stored offer records, delete arbitrary offers by numer...

CVE-2026-89023

The ThemeAtelier Domain For Sale WordPress plugin, in versions before 3.5.2 , suffers from a missing authorization flaw in its REST API endpoints . Unauthenticated attackers can retrieve stored offer records, delete arbitrary offers by numeric identifier, and access dashboard statistics that disc...

WordPress Eventin - Event Calendar, Tickets, Registration, Booking & WooCommerce plugin <= 4.1.23 - Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter vulnerability

WordPress Eventin - Event Calendar, Tickets, Registration, Booking & WooCommerce plugin = 4.1.23 - Authenticated Subscriber+ Privilege Escalation via mapmetacap Filter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WP Event Solution versions = 4.1.23...

WordPress PublishPress Authors plugin <= 4.15.0 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin PublishPress Authors versions = 4.15.0...

WordPress Booking for Appointments and Events Calendar plugin < 2.4.10 - Amelia Manager+ WordPress Account Takeover vulnerability

Amelia Manager+ WordPress Account Takeover vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Amelia versions 2.4.10...

WordPress Export & Import WPBakery Page Builder plugin <= 1.0.2 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Suhayb Ahmed cyboltx in WordPress Plugin Export & Import WPBakery Page Builder versions = 1.0.2...

WordPress Booking for Appointments and Events Calendar plugin 9.0-9.8.0 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Pedro Pinho in WordPress Plugin Amelia versions 9.0-9.8.0...

WordPress YayPricing plugin < 3.5.7 - Subscriber+ Stored XSS vulnerability

Subscriber+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin YayPricing versions 3.5.7...

WordPress BE REST Endpoints plugin <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation vulnerability

Unauthenticated Stored XSS and Widget Manipulation vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin BE REST Endpoints versions = 1.0.0...

WordPress Hoo Companion plugin 1.0.2 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Enrico Marcolini Dottor Marc, Claudio Marchesini Dottor Marc in WordPress Plugin Hoo Companion versions 1.0.2...

WordPress Rox Appointment Booking plugin < 1.2.0 - Unauthenticated Holiday Schedule Modification vulnerability

Unauthenticated Holiday Schedule Modification vulnerability discovered by Pedro Pinho in WordPress Plugin Rox Appointment Booking Appointment Booking Scheduling Solution versions 1.2.0...

WordPress Rox Appointment Booking plugin < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass vulnerability

Unauthenticated Price Manipulation and Payment Method Restriction Bypass vulnerability discovered by Morato Antoine in WordPress Plugin Rox Appointment Booking Appointment Booking Scheduling Solution versions 1.2.0...

WordPress Simple Membership plugin < 4.7.8 - Subscriber+ Membership Level Escalation vulnerability

Subscriber+ Membership Level Escalation vulnerability discovered by Charles Vosburgh in WordPress Plugin Simple Membership versions 4.7.8...

WordPress Mobile Events Manager plugin <= 1.4.8.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Enrico Marcolini Dottor Marc, Claudio Marchesini Dottor Marc in WordPress Plugin Mobile Events Manager versions = 1.4.8.3...