PT-2026-90795

The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment button, allowing members to pay for a lower-priced membership while being granted a higher, more privileged...

PT-2026-90790

The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session check on one of its public AJAX actions, allowing unauthenticated users to read the submitted entries of any form created with a supported third-party form Conta...

CVE-2026-85129: Improper Neutralization of Input During Web Page Generation

The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which wi...

CVE-2026-81648: Missing Authorization

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration an...

CVE-2026-10148

The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Elementor widgets in versions up to and including 2.4.9. This is due to insufficient input sanitization and output escaping on the 'loadmanually' parameter in the render...

CVE-2026-15451

The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the 'addsubaccountuser' function that passes the raw 'userdata' array to 'wpinsertuser' without filtering...

CVE-2026-10148

The Amelia (Booking for Appointments and Events Calendar) WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 2.4.9 . The root cause is insufficient input sanitization and output escaping on the load_manually parameter within the render() methods of...

CVE-2026-10148 Booking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter

The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Elementor widgets in versions up to and including 2.4.9. This is due to insufficient input sanitization and output escaping on the 'loadmanually' parameter in the render...

CVE-2026-15451

The MemberPress Corporate Accounts plugin for WordPress is affected by a privilege escalation vulnerability through mass assignment in versions up to and including 1.5.39 . The root cause lies in the add_sub_account_user function, which passes the raw userdata array to wp_insert_user without filt...

CVE-2026-10148 Booking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter

The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Elementor widgets in versions up to and including 2.4.9. This is due to insufficient input sanitization and output escaping on the 'loadmanually' parameter in the render...

EUVD-2026-76874

The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Elementor widgets in versions up to and including 2.4.9. This is due to insufficient input sanitization and output escaping on the 'loadmanually' parameter in the render...

EUVD-2026-76875

The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the 'addsubaccountuser' function that passes the raw 'userdata' array to 'wpinsertuser' without filtering...

CVE-2026-15451 MemberPress Corporate Accounts <= 1.5.39 - Authenticated (Subscriber+) Privilege Escalation via Mass Assignment in Sub-Account Creation

The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the 'addsubaccountuser' function that passes the raw 'userdata' array to 'wpinsertuser' without filtering...

Exploit for CVE-2026-78006

CVE-2026-78006-POC POC for CVE-2026-78006 The Events Calendar...

Exploit for CVE-2026-77771

CVE-2026-77771 — miniOrange 2FA Free & Pro: 2FA Bypass via S...

CVE-2026-78159

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parsearray function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the issafewidgetinstance objec...

CVE-2026-78175

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the withdrawmethodfield parameter of the tutorsavewithdrawaccount AJAX handler. This is due to the handler lacking any capability or role...

CVE-2026-17585

The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1066 via the 'wprkeyword' parameter. This makes it possible for unauthenticated attackers to extract arbitrary...

CVE-2026-11355

The DT LMS – elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX handlers including dtlmssavepocsettings, dtlmssaveskinsettings, and dtlmssaveoptionssettings in versions up to, and including, 1.1. Thes...

CVE-2026-77161

The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to SQL Injection via Parameter Name in all versions up to and including 5.1.24 . The root cause is insufficient escaping on a user-supplied parameter and lack of sufficient preparation of the existing SQL query, allo...