CVE-2026-110651 Swift Performance Lite < 2.3.7.4 - Author+ SQLi via Image Optimizer

The Swift Performance Lite WordPress plugin before 2.3.7.4 does not properly sanitize and escape a value before using it in a SQL statement, which could allow users with the author role and above to perform SQL injection attacks...

CVE-2026-110523

The WP User Manager WordPress plugin versions prior to 2.9.26 is vulnerable to unauthenticated privilege escalation . The flaw occurs because the plugin fails to maintain paid-registration restrictions once a payment gateway is disconnected. Consequently, a published paid registration form will s...

CVE-2026-109147

The WP Booking System WordPress plugin (versions before 2.1.0.3 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to validate and escape the booking_id parameter before reflecting it back on an admin page. This vulnerability could be leveraged to target high-...

CVE-2026-108073

The SureCart WordPress plugin, in versions prior to 4.9.5 , is vulnerable to an unauthenticated private catalog data disclosure. The root cause is that the plugin fails to restrict related objects or strip private fields when an anonymous visitor reads a single upsell funnel via the REST API . Th...

CVE-2026-110651

The Swift Performance Lite WordPress plugin (versions before 2.3.7.4 ) is vulnerable to SQL injection because it fails to properly sanitize and escape a value before utilizing it in a SQL statement. This vulnerability specifically affects users with the author role and above, who could potentiall...

CVE-2026-110514

The WPZOOM Portfolio Lite WordPress plugin (versions before 1.4.34 ) contains an Authorization Bypass vulnerability (CWE-639). The application fails to verify if a user has the necessary permissions to edit a post before allowing modifications to its type and order . This flaw enables users with ...

CVE-2026-109147 WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter

The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators...

EUVD-2026-107065

The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API, nor strip private fields from those objects, allowing unauthenticated users to read merchant-private catalog data such as...

EUVD-2026-107070

The Swift Performance Lite WordPress plugin before 2.3.7.4 does not properly sanitize and escape a value before using it in a SQL statement, which could allow users with the author role and above to perform SQL injection attacks...

EUVD-2026-107066

The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators...

EUVD-2026-107069

The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and...

EUVD-2026-107068

The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order, which could allow users with the contributor role and above to convert any other user's posts and pages into portfolio items, removing them from their...

CVE-2026-107789 SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers...

CVE-2026-107790 WP Job Openings < 4.1.1 - Author+ Stored XSS via Job Title

The HireZoot WordPress plugin before 4.1.1 does not sanitise and escape some of its stored data before outputting it in the admin dashboard, and additionally reverses the HTML-entity encoding that would otherwise neutralise it, allowing users with the Author role to perform Stored Cross-Site...

CVE-2026-107506 Simple Banner < 3.3.3 - Authenticated Privilege Escalation via User Permissions Setting

The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such roles the full administrator capability, which allows users in a low-privileged role to escalate their privileges and...

CVE-2026-107790 WP Job Openings < 4.1.1 - Author+ Stored XSS via Job Title

The HireZoot WordPress plugin before 4.1.1 does not sanitise and escape some of its stored data before outputting it in the admin dashboard, and additionally reverses the HTML-entity encoding that would otherwise neutralise it, allowing users with the Author role to perform Stored Cross-Site...

CVE-2026-107789 SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers...

CVE-2026-107506 Simple Banner < 3.3.3 - Authenticated Privilege Escalation via User Permissions Setting

The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such roles the full administrator capability, which allows users in a low-privileged role to escalate their privileges and...

CVE-2026-107790

The HireZoot WordPress plugin (also referred to as WP Job Openings ) versions prior to 4.1.1 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape stored data before it is displayed in the admin dashboard; furthermore, the plugin revers...

CVE-2026-107789

The SmartyParcel WordPress plugin versions before 1.23.4 is vulnerable to an unauthenticated shipping label disclosure due to a lack of authorization checks. An attacker can obtain shipping labels for arbitrary orders, which contain sensitive information such as customer names, addresses, and pho...