EUVD-2026-70992

The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment...

CVE-2026-82923 AI Website Builder (GitHub build) 1.0.0 - Unauthenticated RCE via Unprotected REST Routes

The AI Website Builder WordPress plugin GitHub build 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into th...

CVE-2026-84043 ePayco Payment Gateway for WooCommerce < 8.4.7 - Unauthenticated Payment Confirmation Bypass

The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of payment confirmation requests, allowing unauthenticated attackers to mark orders as paid without a valid gateway signature...

EUVD-2026-70991

The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of payment confirmation requests, allowing unauthenticated attackers to mark orders as paid without a valid gateway signature...

EUVD-2026-70990

The AI Website Builder WordPress plugin GitHub build 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into th...

CVE-2026-82923

The AI Website Builder WordPress plugin (GitHub build 1.0.0 ) lacks any authorization or nonce check on its REST API routes. This allows an unauthenticated attacker to install and activate plugins and themes, import content from an attacker-controlled URL, write an arbitrary file into the uploads...

CVE-2026-27086

CVE-2026-27086 affects the WordPress WoodMart theme by Xtemos , versions before 8.3.8 . The vulnerability is a DOM-Based Cross-Site Scripting (XSS) caused by improper neutralization of input during web page generation. The CVSS 3.1 score is 6.5 (Medium) , with a changed scope and low impact on co...

CVE-2026-27086 WordPress WoodMart theme < 8.3.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Xtemos WoodMart allows DOM-Based XSS. This issue affects WoodMart: from n/a before 8.3.8...

WordPress WoodMart theme < 8.3.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme WoodMart versions 8.3.8...

CVE-2026-27432

Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Rentals: from n/a before 3.16.0...

CVE-2026-32480

Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership: from n/a through 2.11.11...

Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws

Threat actors are exploiting two critical security flaws in WordPress plugins Super Forms and Elementor Pro, according to findings from Wordfence. The vulnerabilities in question are - CVE-2026-14894 CVSS score: 9.8 - A missing file type validation vulnerability in Super Forms – Drag & Drop Form...

CVE-2026-27432 WordPress WP Rentals theme < 3.16.0 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Rentals: from n/a before 3.16.0...

WordPress WP Rentals theme < 3.16.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Rafie Muhammad in WordPress Theme WP Rentals versions 3.16.0...

CVE-2026-57777

Automattic WooCommerce (WordPress plugin) versions prior to 11.0 are affected by a Blind SQL Injection vulnerability in the plugin's handling of special elements in SQL commands. The vulnerability is rated CVSS 3.1: 7.6 (HIGH) , with an attack vector of network , low complexity , and high privile...

CVE-2026-57777 WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Automattic WooCommerce allows Blind SQL Injection. This issue affects WooCommerce: from n/a before 11.0...

CVE-2026-57777 WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Automattic WooCommerce allows Blind SQL Injection. This issue affects WooCommerce: from n/a before 11.0...

WordPress WooCommerce plugin <= 10.9.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WooCommerce versions = 10.9.4...

CVE-2026-85311 WordPress MarketKing plugin <= 2.1.60 - Broken Access Control vulnerability

Missing Authorization vulnerability in Kings Plugins MarketKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MarketKing: from n/a through 2.1.60...

CVE-2026-85311

CVE-2026-85311 is a Missing Authorization (Broken Access Control) vulnerability in the MarketKing WordPress plugin by Kings Plugins, affecting versions up to 2.1.60 . The flaw allows an unauthenticated remote attacker to exploit incorrectly configured access control security levels, resulting in ...