EUVD-2026-74702

The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel the payment on any customer's booking...

CVE-2026-18042 WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Cancellation

The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel the payment on any customer's booking...

WordPress Payment Plugins for PayPal WooCommerce plugin < 2.0.26 - Unauthenticated Customer PII Disclosure vulnerability

Unauthenticated Customer PII Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin Payment Plugins for PayPal WooCommerce versions 2.0.26...

CVE-2026-75861 Ultimate Gift Cards for WooCommerce < 3.2.10 - Subscriber+ Gift Card Theft and Destruction via Unauthorized Redemption

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not verify that the user redeeming a gift card is its intended recipient, allowing any authenticated user, such as a subscriber, to redeem gift cards belonging to other users, zeroing their balance and crediting the value...

CVE-2026-80341

CVE-2026-80341 affects the Payment Plugins for PayPal WooCommerce WordPress plugin prior to version 2.0.26 . The plugin fails to verify that a stored payment method belongs to the user attaching it — an IDOR flaw — allowing any authenticated user (e.g., a subscriber) to bind another customer's st...

EUVD-2026-74703

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not verify that the user redeeming a gift card is its intended recipient, allowing any authenticated user, such as a subscriber, to redeem gift cards belonging to other users, zeroing their balance and crediting the value...

CVE-2026-18042

WP Travel WordPress plugin versions before 12.0.2 fail to verify that the requester is authorized to act on the booking targeted by its front-end payment-message handlers. This missing authorization check allows unauthenticated attackers to cancel the payment on any customer's booking, resulting ...

WordPress WP Travel plugin < 12.0.2 - Unauthenticated Arbitrary Booking Cancellation vulnerability

Unauthenticated Arbitrary Booking Cancellation vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Travel versions 12.0.2...

WordPress Payment Plugins for Stripe WooCommerce plugin < 4.0.12 - Unauthenticated Customer PII Disclosure vulnerability

Unauthenticated Customer PII Disclosure vulnerability discovered by m1w34p0n in WordPress Plugin Stripe For WooCommerce versions 4.0.12...

EUVD-2025-210873

The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewi...

EUVD-2026-74700

The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks and extract arbitrary data from the database...

CVE-2026-14962 ELEX WooCommerce Request a Quote < 2.4.1 - Unauthenticated SQLi via variation_id

The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks and extract arbitrary data from the database...

WordPress Content Mask plugin 1.7.1-1.8.5.5 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Andrea Fiocchi in WordPress Plugin Content Mask versions 1.7.1-1.8.5.5...

WordPress WP Travel plugin < 12.0.2 - Unauthenticated Booking Payment State Tampering vulnerability

Unauthenticated Booking Payment State Tampering vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin WP Travel versions 12.0.2...

CVE-2026-16960

The Loops & Logic WordPress plugin (versions before 4.3.0 ) exposes an unrestricted public template-data action , allowing unauthenticated users to read arbitrary user records—including email addresses and roles —as well as arbitrary site options. The root cause is a missing permission check on t...

EUVD-2026-74701

The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records including email addresses and roles and arbitrary site options...

EUVD-2026-74699

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a...

CVE-2026-13144

WP Travel is a WordPress plugin that before version 12.0.2 fails to properly verify requester authorization on one branch of its bank-deposit handler. An unauthenticated attacker who knows a target customer's email address can reset that customer's booking payment to an unpaid state and wipe its ...

CVE-2026-16960 Loops & Logic < 4.3.0 - Unauthenticated User Data and Site Option Disclosure

The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records including email addresses and roles and arbitrary site options...

CVE-2026-13146

WP Travel is a WordPress plugin that facilitates travel booking management. Versions before 12.0.2 contain an Insecure Direct Object Reference (IDOR) flaw in the bank-deposit slip submission endpoint: the plugin does not properly verify that the requester owns the targeted booking. An unauthentic...