CVE-2026-28003

Unauthenticated Cross Site Scripting XSS in Maspik – Spam blacklist = 2.9.1 versions...

CVE-2026-27999

Subscriber Broken Access Control in Tourfic = 2.23.1 versions...

CVE-2026-28004

Unauthenticated Cross Site Scripting XSS in Business Directory = 6.4.25 versions...

CVE-2026-27543

Unauthenticated Privilege Escalation in MStore API = 4.20.0 versions...

CVE-2026-28002 WordPress Booktics plugin 1.0.22 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22...

CVE-2026-28002

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22...

CVE-2026-73401

Unauthenticated Broken Access Control in InstaWP Connect = 0.1.3.7 versions...

CVE-2026-73403

Unauthenticated Broken Access Control in User Registration = 5.2.6 versions...

CVE-2026-73357

Donor Cross Site Scripting XSS in GiveWP 4.16.6 versions...

CVE-2026-73349

Unauthenticated Broken Access Control in GiveWP 4.16.6 versions...

CVE-2026-73353

Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce 4.22.10 versions...

CVE-2026-73346

Administrator SQL Injection in MailChimp For WooCommerce 6.2 versions...

CVE-2026-73344

Author Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...

CVE-2026-73340

Contributor Cross Site Scripting XSS in Featured Image from URL = 5.3.3 versions...

CVE-2026-73188

Unauthenticated Sensitive Data Exposure in KiviCare = 4.5.1 versions...

CVE-2026-66704 WordPress Gutenverse Companion plugin <= 2.5.1 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery SSRF in Gutenverse Companion = 2.5.1 versions...

CVE-2026-66700

Unauthenticated Cross Site Scripting XSS in Smart Online Order for Clover = 1.6.1 versions...

CVE-2026-66700 WordPress Smart Online Order for Clover plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Smart Online Order for Clover = 1.6.1 versions...

CVE-2026-66704

Unauthenticated Server Side Request Forgery SSRF in Gutenverse Companion = 2.5.1 versions...

CVE-2026-66704

Unauthenticated Server Side Request Forgery SSRF in Gutenverse Companion = 2.5.1 versions...