EUVD-2026-92966

The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where...

CVE-2026-94271 Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Confirmation Forgery via Unverified Success Return

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does not check the payment status or amount, allowing unauthenticated users to have orders marked as paid without any payment being...

Exploit for CVE-2026-8206

🛡️ CVE-2026-8206: Unauthenticated Account Takeover Lab Analysi...

CVE-2026-75962 Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log)

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and...

EUVD-2026-92961

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and...

CVE-2026-75962

The Post SMTP WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 4.0.1 . The root cause is insufficient input sanitization and output escaping regarding the 'user_email' parameter. Attackers can bypass the plugin's validator by using numeric HT...

CVE-2026-41563 WordPress Sitemovr plugin <= 1.0.1 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Sitemovr = 1.0.1 versions...

CVE-2026-41563 WordPress Sitemovr plugin <= 1.0.1 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Sitemovr = 1.0.1 versions...

CVE-2026-39760 WordPress Real 3D FlipBook plugin <= 5.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Real 3D FlipBook = 5.5 versions...

CVE-2026-39599 WordPress WDS MCP Content Manager plugin <= 3.10.4 - Broken Access Control vulnerability

Contributor Broken Access Control in WDS MCP Content Manager = 3.10.4 versions...

CVE-2026-32582 WordPress IATO MCP plugin <= 1.12.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in iatoai IATO MCP iato-mcp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IATO MCP: from n/a through 1.12.0...

CVE-2026-32582

The WordPress IATO MCP plugin in versions

CVE-2026-32576

The Faktur Pro for WooCommerce plugin, specifically versions

wordpress-jetpack-broken-access-control-vulnerable-application

wordpress-jetpack-broken-access-control-vulnerable-application Esta es una aplicación vulnerable para probar el exploit del control de acceso roto Jetpack 13.9.1 CVE-2024-9926. ¡ADVERTENCIA! Esta aplicación contiene vulnerabilidades de seguridad graves. ¡Ejecútela bajo su propio riesgo! Se...

CVE-2026-0920

CVE-2026-0920 Scanner A Python-based scanner for detecting and validating CVE-2026-0920 exposure in WordPress sites using vulnerable LA-Studio Element plugin versions. Overview This tool is designed to automate the identification of WordPress targets potentially affected by CVE-2026-0920 , a...

CVE-2026-94270: Improper Authentication

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and ships with that verification disabled by default, allowing unauthenticated attackers to mark an unpaid order as paid, or to cancel or refund an existing order...

PT-2026-106342

The ACPT Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes ...

CVE-2026-94278: Improper Access Control

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored si...

CVE-2026-75962: Improper Neutralization of Input During Web Page Generation

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and...

PT-2026-106333

Name of the Vulnerable Software and Affected Versions Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App versions prior to 4.0.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform...