WordPress Masteriyo LMS plugin 1.3.1-2.3.3 - Unauthenticated Course Enrollment Disclosure vulnerability

Unauthenticated Course Enrollment Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Masteriyo - LMS versions 1.3.1-2.3.3...

WordPress WPLP Cookie Consent plugin < 4.4.2 - Subscriber+ Banner Settings Overwrite and A/B Test Data Reset vulnerability

Subscriber+ Banner Settings Overwrite and A/B Test Data Reset vulnerability discovered by RIA Labs in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions 4.4.2...

CVE-2026-82185

The WPLP Cookie Consent WordPress plugin (versions before 4.4.2 ) is vulnerable to an authorization bypass due to missing capability or nonce checks on specific A/B testing actions. This flaw allows any authenticated user , such as a subscriber, to overwrite the cookie banner configuration displa...

CVE-2026-84068

The Quentn WP WordPress plugin (versions 1.2.13 through 1.2.14 ) is vulnerable to an unauthenticated SQL injection vulnerability. The root cause is the inadequate escaping of the 'qntn_wp' request parameter before its use in an unprepared SQL query. This flaw allows unauthenticated attackers to e...

CVE-2026-81021

The SupportCandy WordPress plugin (versions 3.2.9-3.5.2 ) contains an authorization bypass vulnerability. The software fails to perform an authorization check on specific support-ticket attachment download paths. This allows unauthenticated attackers to read protected customer-uploaded attachment...

EUVD-2026-74707

The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers...

CVE-2026-82184 WPLP Cookie Consent < 4.4.2 - Unauthenticated IAB TCF Consent Option Update

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have any authorisation or CSRF checks when storing visitor consent state, and the code that does so runs on every front-end page load, allowing unauthenticated attackers to overwrite a site-wide option with arbitrary data...

WordPress WPLP Cookie Consent plugin < 4.4.2 - Unauthenticated IAB TCF Consent Option Update vulnerability

Unauthenticated IAB TCF Consent Option Update vulnerability discovered by Alex Spataru in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions 4.4.2...

CVE-2026-82184 WPLP Cookie Consent < 4.4.2 - Unauthenticated IAB TCF Consent Option Update

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have any authorisation or CSRF checks when storing visitor consent state, and the code that does so runs on every front-end page load, allowing unauthenticated attackers to overwrite a site-wide option with arbitrary data...

CVE-2026-81741 Groundhogg < 4.7.2 - Open Redirect via 'redirect_to' Parameter

The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2 does not restrict the redirect target of its email preference confirmation flow to the site's own host, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL by way of a crafte...

EUVD-2026-74708

The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, allowing unauthenticated users to read the contents of any support ticket...

CVE-2026-81022 SupportCandy 3.3.6 - 3.5.2 - Unauthenticated Ticket Content Disclosure via Auth Code Leak

The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, allowing unauthenticated users to read the contents of any support ticket...

EUVD-2026-74709

The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2 does not restrict the redirect target of its email preference confirmation flow to the site's own host, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL by way of a crafte...

WordPress Groundhogg — CRM, Newsletters, and Marketing Automation plugin < 4.7.2 - Open Redirect vulnerability

Open Redirect vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Groundhogg versions 4.7.2...

EUVD-2026-74710

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have any authorisation or CSRF checks when storing visitor consent state, and the code that does so runs on every front-end page load, allowing unauthenticated attackers to overwrite a site-wide option with arbitrary data...

CVE-2026-81021 SupportCandy 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment Disclosure

The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers...

CVE-2026-81741

The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin versions before 4.7.2 is vulnerable to an Open Redirect vulnerability. The issue occurs because the plugin fails to restrict the redirect target within its email preference confirmation flow to the site's own host. This ...

CVE-2026-81022

The SupportCandy WordPress plugin affects versions 3.3.6 through 3.5.2 . The vulnerability exists because the plugin fails to validate a submitted per-ticket authorization code before disclosing the actual code to the requester. This flaw allows unauthenticated users to read the contents of any s...

CVE-2026-82184

The WPLP Cookie Consent (also known as WP Cookie Notice for GDPR, CCPA & ePrivacy Consent ) WordPress plugin versions before 4.4.2 is vulnerable to an unauthenticated option overwrite. The root cause is a lack of authorisation and CSRF checks when the plugin stores visitor consent state, which oc...

WordPress SupportCandy plugin 3.3.6-3.5.2 - Unauthenticated Ticket Content Disclosure vulnerability

Unauthenticated Ticket Content Disclosure vulnerability discovered by Mitre Osman Hussein in WordPress Plugin SupportCandy versions 3.3.6-3.5.2...