CVE-2026-81794 WordPress Shirt Product Designer for WooCommerce plugin 1.0.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions...

CVE-2026-81791 WordPress EventON plugin <= 2.5.7 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in EventON = 2.5.7 versions...

CVE-2026-81793 WordPress Salon booking system plugin <= 10.31.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Salon booking system = 10.31.5 versions...

CVE-2026-81791

The WordPress EventON plugin , versions

CVE-2026-81793

An unauthenticated Broken Access Control vulnerability affects the WordPress Salon booking system plugin in versions 10.31.5 and earlier . Discovered by Tiago Ventura (@perses), the flaw allows attackers to access or modify data with low integrity and low availability impact without requiring any...

CVE-2026-81791 WordPress EventON plugin <= 2.5.7 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in EventON = 2.5.7 versions...

CVE-2026-81789 WordPress Advanced Product Fields Extended for WooCommerce plugin <= 3.1.6 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Studio Wombat Advanced Product Fields Extended for WooCommerce allows Path Traversal. This issue affects Advanced Product Fields Extended for WooCommerce: from n/a through 3.1.6...

CVE-2026-81789 WordPress Advanced Product Fields Extended for WooCommerce plugin <= 3.1.6 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Studio Wombat Advanced Product Fields Extended for WooCommerce allows Path Traversal. This issue affects Advanced Product Fields Extended for WooCommerce: from n/a through 3.1.6...

CVE-2026-81789

Advanced Product Fields Extended for WooCommerce WordPress plugin, versions ≤ 3.1.6 , is affected by an unauthenticated arbitrary file deletion vulnerability. The CVSS 3.1 score is 8.6 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, indicating a network-exploitable issue requiring no...

CVE-2026-81788 WordPress IMPress for IDX Broker plugin <= 3.3.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in IMPress for IDX Broker = 3.3.0 versions...

CVE-2026-81787 WordPress IMPress for IDX Broker plugin <= 3.3.0 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in IMPress for IDX Broker = 3.3.0 versions...

CVE-2026-81788

CVE-2026-81788 affects the WordPress IMPress for IDX Broker plugin in versions

CVE-2026-81788 WordPress IMPress for IDX Broker plugin <= 3.3.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in IMPress for IDX Broker = 3.3.0 versions...

CVE-2026-81787 WordPress IMPress for IDX Broker plugin <= 3.3.0 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in IMPress for IDX Broker = 3.3.0 versions...

CVE-2026-81786 WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce = 1.2.2 versions...

CVE-2026-81786

Unauthenticated Broken Access Control in the Thank You Page Customizer for WooCommerce WordPress plugin (versions ≤ 1.2.2 ) allows an unauthenticated remote attacker to access resources without proper authorization. The vulnerability carries a CVSS 3.1 base score of 7.5 (HIGH) , with high confide...

CVE-2026-81786 WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce = 1.2.2 versions...

EUVD-2026-75519

Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce = 1.2.2 versions...

CVE-2026-81784

An unauthenticated PHP Object Injection vulnerability affects the WordPress Wise Chat plugin in versions ≤ 3.4 , as discovered by Peng Zhou . The flaw allows a remote attacker with no prior access or user interaction to inject a crafted serialized object, leading to high impact on confidentiality...

CVE-2026-81785

CVE-2026-81785 affects the WordPress BuddyForms plugin , versions 2.9.0 and earlier . The vulnerability is an unauthenticated Broken Access Control flaw, meaning an attacker can exploit it over the network without any credentials or user interaction. The CVSS v3.1 score is 6.5 (Medium) , with low...