CVE-2026-89288 Fast Courier 5.0.0 - 5.2.3 - Unauthenticated SQLi via 'wp_order_id' Parameter

The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...

CVE-2026-87974 Asaas Gateway for WooCommerce < 2.7.8 - Unauthenticated Order Payment Bypass via Webhook

The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its payment webhook, accepting an empty access token in its default configuration and not verifying that the confirmed payment corresponds to the order it marks paid, allowing unauthenticated attackers ...

EUVD-2026-100860

The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...

WordPress Tainacan plugin < 1.4.0 - Subscriber+ Repository Staff Email Address Disclosure vulnerability

Subscriber+ Repository Staff Email Address Disclosure vulnerability discovered by Artus KG in WordPress Plugin Tainacan versions 1.4.0...

EUVD-2026-100861

The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subscriber to read the email addresses of the repository's staff...

CVE-2026-90989

The Tainacan WordPress plugin before version 1.4.0 contains a vulnerability where its reports REST endpoints lack proper access controls. Specifically, the plugin fails to restrict these endpoints to users with management capabilities, which allows any authenticated subscriber to disclose the ema...

CVE-2026-86799

The Forms WordPress plugin (versions before 3.0.2 ) is vulnerable to unauthenticated stored XSS . The root cause is a failure to sanitise submitted form values on storage and a failure to escape those values before they are outputted on the form submissions screen within the administration dashbo...

WordPress Pricing Table plugin 1.0.7-2.1.4 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Philipp Doblhofer in WordPress Plugin Pricing Table block – Display product prices as a table. versions 1.0.7-2.1.4...

CVE-2026-108064 WP Encryption < 7.8.8.2 - Unauthenticated Certificate Private Key and ACME Order Replacement via wple_auto_handler

The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routine, allowing unauthenticated users to make the WP Encryption WordPress plugin before 7.8.8.2 overwrite the site's certificate...

CVE-2026-85000 EmbedPress < 4.6.8 - Unauthenticated YouTube API Quota Consumption and Database Bloating

The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credential-bearing request to a third-party API and stores attacker-controlled cache entries, allowing unauthenticated attackers to consume the si...

CVE-2026-108064

The WP Encryption WordPress plugin versions before 7.8.8.2 contains a vulnerability in its SSL certificate-provisioning routine. Due to a lack of capability or nonce checks on the wple_auto_handler , unauthenticated users can overwrite the site's certificate private key and replace pending Let's ...

CVE-2026-107319

The GamiPress WordPress plugin before version 8.0.6 is vulnerable to an activity log disclosure due to a missing capability check and ownership verification on an authenticated AJAX action . This flaw allows any authenticated user, such as a Subscriber , to read arbitrary entries from the activit...

CVE-2026-107320

The GamiPress WordPress plugin, in versions 7.9.5 through 8.0.5 , contains a vulnerability where it fails to properly authorize access to private activity log entries . This flaw allows unauthenticated users to retrieve the private activity logs of all users on the site. This issue represents an ...

CVE-2026-107160

The LTL Freight Quotes – Old Dominion Edition WordPress plugin (versions before 4.2.19 ) is vulnerable to unauthenticated stored HTML injection . The flaw exists because the plugin fails to perform proper authorization checks or input sanitization before storing specific request values. This allo...

EUVD-2026-100891

The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing unauthenticated users to retrieve the private activity logs of all users. This is an incomplete fix of CVE-2026-13450...

CVE-2026-107320 GamiPress 7.9.5 - 8.0.5 - Unauthenticated Private Activity Log Disclosure

The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing unauthenticated users to retrieve the private activity logs of all users. This is an incomplete fix of CVE-2026-13450...

CVE-2026-106469

The Gutenverse Form WordPress plugin versions before 3.0.11 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is a failure to sanitize SVG icon markup stored in form blocks before it is decoded and inserted into the browser page. This allows authenticated users with Contri...

EUVD-2026-100887

The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that writes to the database, allowing unauthenticated users to modify some of the LTL Freight Quotes WordPress plugin before 4.2.19's stored settings...

CVE-2026-106166

The NEX-Forms WordPress plugin versions before 9.3.1 is vulnerable to unauthenticated arbitrary form entry modification. The flaw exists because the plugin fails to perform authorization, ownership, or request-validation checks before updating stored entries. An unauthenticated attacker can use t...

CVE-2026-106166 NEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_entry_update_id' Parameter

The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing...