CVE-2026-13407

CVE-2026-13407 affects the Royal Elementor Addons WordPress plugin in versions before 1.7.1067 . The form widget does not properly sanitize and escape submitted values before including them in administrator notification emails, allowing unauthenticated attackers to inject arbitrary HTML into emai...

MAL-2026-16210 Malicious code in strapi-plugin-pencc-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b4277c223cb7d5a9b8c263570a18670ee5054779862fbb801024a55629aa208 postinstall.js is registered as the package's postinstall script and runs automatically on npm install. It compares os.hostname to the hardcoded stri...

Malicious code in strapi-plugin-pencc-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b4277c223cb7d5a9b8c263570a18670ee5054779862fbb801024a55629aa208 postinstall.js is registered as the package's postinstall script and runs automatically on npm install. It compares os.hostname to the hardcoded stri...

MAL-2026-16209 Malicious code in strapi-plugin-ccsuc-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fb6207f1b4ec4d94c724583a5f32b85f68d203e1a9e6372705b410efbf9173a The package's postinstall lifecycle script postinstall.js, wired via scripts.postinstall in package.json checks the installer's hostname against a...

Malicious code in strapi-plugin-ccsuc-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fb6207f1b4ec4d94c724583a5f32b85f68d203e1a9e6372705b410efbf9173a The package's postinstall lifecycle script postinstall.js, wired via scripts.postinstall in package.json checks the installer's hostname against a...

CVE-2026-87854

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and...

CVE-2026-87828

The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire...

CVE-2026-87860

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...

CVE-2026-87907

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category...

CVE-2026-88910

The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board media, allowing unauthenticated attackers to permanently delete its uploaded media files and their database records by iterating identifiers...

CVE-2026-89328

The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges before performing several board-management operations, checking only board membership. This allows any member of a board to carry out manager-only actions on it, including adding or...

CVE-2026-87896

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent staff records, allowing unauthenticated attackers to read staff email addresses, phone numbers, private internal notes and the linked WordPress account nam...

CVE-2026-89327

The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is the user the comment is attributed to, allowing any board member to post comments that appear to be authored by another user, including administrators...

CVE-2026-86823

The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthenticated attackers to redirect users to arbitrary external sites and to disclose a subscriber token that grants access to that subscriber...

CVE-2026-85530

The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user...

CVE-2026-85569

The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permission recorded against an API credential, allowing the holder of a read-only key to act as the administrator account that issued it...

CVE-2026-85641

The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in th...

CVE-2026-86449

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed one...

CVE-2026-86784

The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such...

CVE-2026-85349

The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authenticated user, including a Subscriber with no board access, to disclose the private board memberships of arbitrary users by referencing the...