CVE-2026-66658

Subscriber SQL Injection in Reviewer = 3.14.2 versions...

CVE-2026-66658

CVE-2026-66658 affects WordPress Reviewer plugin versions ≤ 3.14.2. The issue is described as a SQL Injection vulnerability (Subscriber SQL Injection) with CVSS 3.1, base score 8.5 (HIGH), vector: NETWORK/attackVector N, AC:L, PR:L, UI:N, S:C, C:H, I:N, A:L. Connected sources include CVE records ...

CVE-2026-66658 WordPress Reviewer plugin <= 3.14.2 - SQL Injection vulnerability

Subscriber SQL Injection in Reviewer = 3.14.2 versions...

CVE-2026-66657 WordPress Biagiotti Core plugin <= 2.1.1 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Biagiotti Core = 2.1.1 versions...

CVE-2026-66657

Unauthenticated Local File Inclusion in Biagiotti Core = 2.1.1 versions...

EUVD-2026-57896

Unauthenticated Local File Inclusion in Biagiotti Core = 2.1.1 versions...

CVE-2026-66656

CVE-2026-66656 describes an unauthenticated Local File Inclusion in the WordPress Foton Core plugin, versioned = 1.1.2 is advised, but a concrete fix/version is not specified in the provided data.

CVE-2026-66656 WordPress Foton Core plugin <= 1.1.1 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Foton Core = 1.1.1 versions...

CVE-2026-66657

The CVE-2026-66657 entry describes an Unauthenticated Local File Inclusion in the WordPress Biagiotti Core plugin, versions

EUVD-2026-57893

Subscriber Server Side Request Forgery SSRF in Vehica Core = 1.0.104 versions...

CVE-2026-66654

CVE-2026-66654 : A Subscriber Server-Side Request Forgery (SSRF) vulnerability affects WordPress Vehica Core plugin (versions

CVE-2026-66655 WordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.36 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in MultiParcels Shipping For WooCommerce = 1.30.36 versions...

CVE-2026-66654 WordPress Vehica Core plugin <= 1.0.104 - Server Side Request Forgery (SSRF) vulnerability

Subscriber Server Side Request Forgery SSRF in Vehica Core = 1.0.104 versions...

CVE-2026-66655

CVE-2026-66655 refers to an unauthenticated, reflected Cross Site Scripting (XSS) vulnerability in the WordPress plugin MultiParcels Shipping For WooCommerce , affecting versions

EUVD-2026-57892

Unauthenticated Local File Inclusion in Barista = 2.5.1 versions...

CVE-2026-66653

CVE-2026-66653 corresponds to an unauthenticated Local File Inclusion in WordPress Barista theme (versions &lt;= 2.5.1). The vulnerability affects the Barista theme’s file handling, enabling LFI with a high severity (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Root cause details are stated as...

CVE-2026-66653 WordPress Barista theme <= 2.5.1 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Barista = 2.5.1 versions...

CVE-2026-66472 WordPress Everest Backup plugin <= 2.3.12 - SQL Injection vulnerability

Unauthenticated SQL Injection in Everest Backup = 2.3.12 versions...

CVE-2026-66478

The CVE 2026-66478 refers to an unauthenticated SQL Injection in the WordPress plugin Church Admin (versions

CVE-2026-66478

Unauthenticated SQL Injection in Church Admin = 5.1.1 versions...