WordPress MPG plugin < 4.2.3 - Editor+ Arbitrary File Read vulnerability

Editor+ Arbitrary File Read vulnerability discovered by ieuns in WordPress Plugin MPG versions 4.2.3...

WordPress TillKit plugin < 1.0.5 - Unauthenticated POS Takeover vulnerability

Unauthenticated POS Takeover vulnerability discovered by Pedro Pinho in WordPress Plugin TillKit versions 1.0.5...

CVE-2026-84169

The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment...

CVE-2026-13607

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...

CVE-2026-78371

The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files...

CVE-2026-84169 UPI QR Code Payment Gateway <= 1.4.3 - Unauthenticated Cross-Order Payment-Status Forgery

The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment...

CVE-2026-13607 File Uploads Addon for WooCommerce <= 1.7.6 - Unauthenticated Direct File Access

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...

CVE-2026-13607

The File Uploads Addon for WooCommerce WordPress plugin, in versions through 1.7.6 , is vulnerable to unauthenticated direct file access. The root cause is that customer-uploaded files are stored in a publicly web-accessible uploads directory where the plugin's intended access restrictions are in...

CVE-2026-78371 File Uploads Addon for WooCommerce 1.7.2 - 1.7.5 - Unauthenticated Customer Uploaded File Disclosure

The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files...

CVE-2026-13607 File Uploads Addon for WooCommerce <= 1.7.6 - Unauthenticated Direct File Access

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...

CVE-2026-84169

The UPI QR Code Payment Gateway WordPress plugin, affecting versions through 1.4.3 , contains a vulnerability where it fails to verify if a payment-confirmation request belongs to the specific order and customer it claims to confirm. This lack of authorization allows unauthenticated attackers to ...

EUVD-2026-92260

The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment...

EUVD-2026-92261

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...

CVE-2026-78371

The File Uploads Addon for WooCommerce WordPress plugin versions before 1.7.6 contains a vulnerability where it fails to verify the identity of users requesting customer-uploaded files. This lack of authorization allows unauthenticated attackers to download files belonging to other customers if t...

CVE-2026-78371: Authorization Bypass Through User-Controlled Key

The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files...

CVE-2026-13607: Improper Access Control

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...

CVE-2026-105397: Improper Neutralization of Input During Web Page Generation

LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the updatequestion...

CVE-2026-97305: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 2.0.2...

PT-2026-106000

LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the update questio...

CVE-2026-84169: Authorization Bypass Through User-Controlled Key

The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment...