CVE-2026-79632 WPFunnels < 3.13.0 - Unauthenticated Arbitrary Recipient Email Sending via wpfnl_shortcode_optin_submission

The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in submission handlers, and takes the notification recipients and subject from the request, allowing unauthenticated users to make the site send emails to arbitrary recipients with an...

EUVD-2025-210844

The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submissions, relying on a value supplied in the request instead, allowing unauthenticated attackers to create WordPress user accounts even when...

CVE-2025-15691 WPFunnels < 3.13.0 - Unauthenticated User Registration via Opt-in Forms

The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submissions, relying on a value supplied in the request instead, allowing unauthenticated attackers to create WordPress user accounts even when...

EUVD-2026-70900

The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach...

WordPress WPFunnels plugin < 3.13.0 - Unauthenticated User Registration vulnerability

Unauthenticated User Registration vulnerability discovered by D01EXPLOIT OFFICIAL in WordPress Plugin WPFunnels versions 3.13.0...

CVE-2026-16281

The Classified Listing WordPress plugin before 6.1.1 suffers from an IDOR (Insecure Direct Object Reference) in its AI image-editing AJAX action. The plugin fails to verify that the caller owns or can edit the target listing before performing media operations, allowing any authenticated user—incl...

CVE-2026-17517

The Content Views WordPress plugin before 4.5.1.2 fails to verify whether the requesting user is authorized to read the posts returned by a view. This allows unauthenticated attackers to retrieve the title and content of non-public posts—draft, pending, private, and scheduled —whenever a view is ...

EUVD-2026-70901

The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has...

CVE-2026-17517 Content Views < 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure via Views Status Filter

The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has...

CVE-2025-15691

CVE-2025-15691 affects the WPFunnels WordPress plugin in versions prior to 3.13.0 . The vulnerability is an unauthenticated user registration flaw: the plugin does not check whether registration is enabled on the site before creating accounts from opt-in form submissions, instead relying on a val...

WordPress Content Views plugin < 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure vulnerability

Unauthenticated Non-Public Post Content Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Content Views versions 4.5.1.2...

CVE-2026-16281 Classified Listing < 6.1.1 - Subscriber+ Arbitrary Attachment Deletion and Listing Image Tampering via IDOR

The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach...

CVE-2026-11613

The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'customlooptemplate' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing th...

CVE-2026-11613 Divi Ajax Filter <= 5.1.2 - Unauthenticated Local File Inclusion via 'custom_loop_template' Parameter

The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'customlooptemplate' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing th...

EUVD-2026-70888

The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'customlooptemplate' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing th...

CVE-2026-11613

The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to and including 5.1.2 , via the custom_loop_template parameter. Unauthenticated attackers can include and execute arbitrary .php files on the server, potentially bypassing access controls, obtainin...

Divi < 4.27.7 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter

Description The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the etpbsetvideooembedthumbnailresolution function using wpremoteget instead of wpsaferemoteget to fetch a remote image URL, which does not restrict...

Dear Flipbook < 2.4.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.dvcss' Element Class Attribute

Description The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent class attribute of .dvcss element' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization...

The vulnerability of the debugging console for the WatchMan-Site7 plugin of the WordPress content management system allows a hacker to execute arbitrary code.

The vulnerability of the debugging console for the WatchMan-Site7 plugin of the WordPress content management system is related to improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-85405

The ACPT Premium plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.66. This is due to missing authorization in the submit function, which allows unauthenticated form submissions to control the target user ID before calling wp update user. This...