EUVD-2026-80206

The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthenticated attackers to redirect users to arbitrary external sites and to disclose a subscriber token that grants access to that subscriber...

CVE-2026-86784

The Visualizer WordPress plugin (versions before 4.0.8 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to sanitise and escape a chart's JSON data source configuration before it is output back in the chart editor. This allows users with Contributor role p...

CVE-2026-86823

The Newsletter WordPress plugin (versions before 9.3.7 ) contains a vulnerability where it fails to validate the destination of a redirect following a public subscription action. This allows unauthenticated attackers to perform an open redirect to arbitrary external sites and disclose a subscribe...

EUVD-2026-80201

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowing unauthenticated attackers to retrieve the text, identifier and type of every published quiz question on the site, along with a keyword search over them, whi...

CVE-2026-86449 LearnPress < 4.4.7 - Unauthenticated Unpublished Course Disclosure via REST API

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed one...

EUVD-2026-80203

The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file, allowing unauthenticated attackers who can determine its identifier to download customer names, purchases, amounts and guest email...

EUVD-2026-80204

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed one...

CVE-2026-86447

The LearnPress WordPress plugin (versions before 4.4.7 ) is vulnerable to an unauthenticated student enrollment disclosure. The root cause is a failure to check user capabilities within an administrative course tool, specifically the load_content_via_ajax handler. An unauthenticated attacker can ...

EUVD-2026-80202

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unauthenticated attackers to list every enrolled student's display name and user identifier against the course they are enrolled on, and to recover their email...

CVE-2026-86445

The LearnPress WordPress plugin (versions 4.2.9-4.4.6 ) is vulnerable to an unauthenticated question bank disclosure due to a failure to check user capabilities in one of its administrative template handlers. Specifically, the load_content_via_ajax handler allows attackers to retrieve the text, i...

CVE-2026-86449

The LearnPress WordPress plugin (versions 4.2.7.1-4.4.6 ) is vulnerable to an unauthenticated information disclosure flaw. The root cause is a failure to verify user capabilities before applying a user-supplied post status filter within one of its REST routes . This allows unauthenticated attacke...

CVE-2026-86448 LearnPress < 4.4.7 - Unauthenticated Order Data Disclosure via lp_download_order

The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file, allowing unauthenticated attackers who can determine its identifier to download customer names, purchases, amounts and guest email...

CVE-2026-86448

The LearnPress WordPress plugin (versions 4.3.2.8 through 4.4.6 ) is vulnerable to an unauthenticated order data disclosure. The root cause is a lack of authentication, capability, or nonce checks before serving previously generated order export files via the lp_download_order function. An unauth...

CVE-2026-86445 LearnPress < 4.4.7 - Unauthenticated Question Bank Disclosure via load_content_via_ajax

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowing unauthenticated attackers to retrieve the text, identifier and type of every published quiz question on the site, along with a keyword search over them, whi...

CVE-2026-86447 LearnPress < 4.4.7 - Unauthenticated Student Enrollment Disclosure via load_content_via_ajax

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unauthenticated attackers to list every enrolled student's display name and user identifier against the course they are enrolled on, and to recover their email...

EUVD-2026-80197

The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permission recorded against an API credential, allowing the holder of a read-only key to act as the administrator account that issued it...

CVE-2026-85530 GiveWP < 4.16.8.1 - Unauthenticated Account Takeover via Donor Email Sanitization Mismatch

The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user...

EUVD-2026-80198

The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any authenticated user, such as a subscriber, to read comments from courses they are not enrolled in, including comments awaiting moderation...

CVE-2026-85641 Formidable Forms 6.34 - Unauthenticated Stored Content Injection via 'updated_by' Parameter

The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in th...

EUVD-2026-80196

The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user...