CVE-2026-87907 Rox Appointment Booking < 1.2.8 - Unauthenticated Internal Notes Disclosure via Service and Category REST Routes

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category...

CVE-2026-87907

The Rox Appointment Booking WordPress plugin, in versions prior to 1.2.8 , is vulnerable to an unauthenticated internal notes disclosure . The root cause is a lack of authorization checks on the endpoints responsible for returning booking service and category records. This allows unauthenticated ...

CVE-2026-86823 Newsletter < 9.3.7 - Unauthenticated Open Redirect and Subscriber Token Disclosure via ncu Parameter

The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthenticated attackers to redirect users to arbitrary external sites and to disclose a subscriber token that grants access to that subscriber...

EUVD-2026-80206

The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthenticated attackers to redirect users to arbitrary external sites and to disclose a subscriber token that grants access to that subscriber...

CVE-2026-86823 Newsletter < 9.3.7 - Unauthenticated Open Redirect and Subscriber Token Disclosure via ncu Parameter

The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthenticated attackers to redirect users to arbitrary external sites and to disclose a subscriber token that grants access to that subscriber...

CVE-2026-86823

The Newsletter WordPress plugin (versions before 9.3.7 ) contains a vulnerability where it fails to validate the destination of a redirect following a public subscription action. This allows unauthenticated attackers to perform an open redirect to arbitrary external sites and disclose a subscribe...

CVE-2026-86784 Visualizer < 4.0.8 - Contributor+ Stored XSS via JSON Data Source

The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such...

EUVD-2026-80209

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...

CVE-2026-87860 Subscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRF

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...

CVE-2026-86784

The Visualizer WordPress plugin (versions before 4.0.8 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to sanitise and escape a chart's JSON data source configuration before it is output back in the chart editor. This allows users with Contributor role p...

CVE-2026-86784 Visualizer < 4.0.8 - Contributor+ Stored XSS via JSON Data Source

The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such...

CVE-2026-87854 Subscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and...

EUVD-2026-80205

The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such...

CVE-2026-87828 Seraphinite Accelerator < 2.29.24 - Subscriber+ DoS via seraph_accel_State Update

The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire...

EUVD-2026-80207

The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire...

CVE-2026-87828

The Seraphinite Accelerator WordPress plugin (versions before 2.29.24 ) is vulnerable to a denial of service (DoS) attack due to a missing capability check on a state-update AJAX action. This flaw allows authenticated users, such as subscribers , to submit a malformed value that triggers an uncau...

CVE-2026-87854 Subscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and...

CVE-2026-87828 Seraphinite Accelerator < 2.29.24 - Subscriber+ DoS via seraph_accel_State Update

The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire...

CVE-2026-87860 Subscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRF

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...

WordPress Visualizer plugin < 4.0.8 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Visualizer versions 4.0.8...