CVE-2026-14565

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output, allowing any authenticated user such as a subscriber to store JavaScript that executes ...

CVE-2026-14566

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowing any authenticated user such as a subscriber to tamper with the custom metadata of orders belongi...

CVE-2026-83545

The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed...

CVE-2026-74925

The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site...

CVE-2026-82305

The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to rename any wishlist on the site...

CVE-2026-14563

The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to creat...

CVE-2026-14559

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in as any registered user, including administrators, by supplying only that user's email address...

CVE-2026-14560

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server...

CVE-2025-15695

The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scripts build markup from it, allowing users with a role as high as administrator to store JavaScript that runs in the session of any visitor to the site...

WordPress Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button plugin <= 3.5.9 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by uhcna - vietnam in WordPress Plugin Chaty versions = 3.5.9...

WordPress Relevanssi plugin <= 4.28.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Mutantgun in WordPress Plugin Relevanssi versions = 4.28.1...

WordPress OTP Login & Register Woocommerce plugin <= 2.7.2 - Unauthenticated Authentication Bypass via Brute Force vulnerability

Unauthenticated Authentication Bypass via Brute Force vulnerability discovered by d4ngvn in WordPress Plugin OTP Login Woocommerce & Gravity Forms versions = 2.7.2...

WordPress Woo PDF Invoice Builder plugin <= 2.0.8 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Order Information Disclosure vulnerability

Authenticated Subscriber+ Insecure Direct Object Reference to Sensitive Order Information Disclosure vulnerability discovered by Jaskaranjeet Singh - Amity University in WordPress Plugin WooCommerce PDF Invoice Builder versions = 2.0.8...

WordPress Bold Page Builder plugin <= 5.9.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by LevinityCyber in WordPress Plugin Bold Page Builder versions = 5.9.9...

WordPress Sky Addons for Elementor plugin <= 3.8.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Sky Addons for Elementor versions = 3.8.4...

WordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin Simple Payment versions = 2.5.4...

WordPress Amelia plugin <= 2.4.9 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Amelia versions = 2.4.9...

WordPress Passster plugin <= 4.3.13 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Salúa Es-sair in WordPress Plugin Passster versions = 4.3.13...

EUVD-2026-75973

The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its REST API routes for job, backup-destination, and backup-execution management, allowing users holding a BackWPup WordPress plugin before 5.7.5-defined, administrator-assigned limited role to create and r...

WordPress BackWPup plugin 5.2.2-5.7.4 - BackWPup Jobs Checker+ Database Backup Exfiltration vulnerability

BackWPup Jobs Checker+ Database Backup Exfiltration vulnerability discovered by Charles Vosburgh in WordPress Plugin BackWPup versions 5.2.2-5.7.4...