WordPress Theme My Login plugin <= 7.1.15 - Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage vulnerability

Authenticated Subscriber+ Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage vulnerability discovered by Maksim Hayder trjan - Iron Digital Labs LLC in WordPress Plugin Theme My Login versions = 7.1.15...

WordPress MStore API plugin <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery vulnerability

Unauthenticated Authentication Bypass via 'idtoken' Parameter JWT Forgery vulnerability discovered by t4g0 in WordPress Plugin MStore API versions = 4.20.0...

WordPress Dear Flipbook plugin <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via '.df-element' Element Inner HTML vulnerability discovered by tipsen in WordPress Plugin DearFlip versions = 2.4.30...

WordPress Welcart e-Commerce plugin <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback vulnerability

Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback vulnerability discovered by daroo in WordPress Plugin Welcart e-Commerce versions = 2.12.1...

WordPress Events Manager - Calendar, Bookings, Tickets, and more! plugin <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes vulnerability

WordPress Events Manager - Calendar, Bookings, Tickets, and more! plugin = 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes vulnerability discovered by shark3y in WordPress Plugin Events Manager versions = 7.3.3...

CVE-2026-12483

The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndashfileuploadprocess' function, which iterates through an entire array and validates only the first file. This...

EUVD-2026-71098

The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndashfileuploadprocess' function, which iterates through an entire array and validates only the first file. This...

CVE-2026-12483 LearnDash LMS <= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload Handler

The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndashfileuploadprocess' function, which iterates through an entire array and validates only the first file. This...

CVE-2026-12483

The LearnDash LMS plugin for WordPress (versions ≤ 5.1.5 ) is vulnerable to an Unrestricted File Type Upload caused by insufficient input validation in the learndash_fileupload_process function, which validates only the first file in a multi-file array. Authenticated users with subscriber-level a...

WordPress Restaurant Menu and Food Ordering plugin < 2.4.12 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Restaurant Menu by MotoPress versions 2.4.12...

WordPress ePayco Payment Gateway for WooCommerce plugin < 8.4.7 - Unauthenticated Payment Confirmation Bypass vulnerability

Unauthenticated Payment Confirmation Bypass vulnerability discovered by Pedro Pinho in WordPress Plugin Epayco versions 8.4.7...

WordPress Pods plugin 3.3-3.3.9.1 - Author+ Arbitrary File Read vulnerability

Author+ Arbitrary File Read vulnerability discovered by Erwan LR WPScan in WordPress Plugin Pods versions 3.3-3.3.9.1...

CVE-2026-84045

The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking...

CVE-2026-27347

Missing Authorization vulnerability in Crocoblock JetPopup allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JetPopup: from n/a through 2.0.20.2...

CVE-2026-27347

A Missing Authorization (Broken Access Control) vulnerability in the Crocoblock JetPopup WordPress plugin allows exploitation of incorrectly configured access control security levels. The issue affects versions from unknown through 2.0.20.2 . The CVSS 3.1 score is 5.3 (Medium) with a network atta...

EUVD-2026-70999

Missing Authorization vulnerability in Crocoblock JetPopup allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JetPopup: from n/a through 2.0.20.2...

CVE-2026-27347 WordPress JetPopup plugin <= 2.0.20.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Crocoblock JetPopup allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JetPopup: from n/a through 2.0.20.2...

WordPress JetPopup plugin <= 2.0.20.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Bonds in WordPress Plugin JetPopup versions = 2.0.20.2...

CVE-2026-82923

The AI Website Builder WordPress plugin GitHub build 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into th...

EUVD-2026-70993

The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking...