EUVD-2026-75265

The zipMoneyZip Co Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options...

CVE-2026-82925 Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or...

CVE-2026-77771 miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP Lockout

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a...

CVE-2026-82925

The Site Reviews WordPress plugin (versions before 8.3.0 ) is vulnerable to an unauthenticated PHP object injection due to improper handling of request data deserialization. The plugin derives a protection key by padding the site's WordPress nonce key; if this key is absent, left at a sample valu...

CVE-2026-77771

The miniOrange Two-Factor Authentication WordPress plugin (Free and Pro) is vulnerable to a 2FA bypass due to improper authentication (CWE-287 ). In versions before 6.3.1 (Free) and 19.3 (Pro), the plugin fails to scope second-factor attempt limits to the targeted account, instead using a client-...

CVE-2026-77770 miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every...

CVE-2026-77770

The miniOrange 2FA WordPress plugin (versions before 6.3.1 and before 19.3 ) is vulnerable to unauthenticated arbitrary option deletion . The root cause is the lack of a validated transaction before deleting site options based on unauthenticated request input. An attacker can exploit this by send...

CVE-2026-77770 miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every...

CVE-2026-19436 Ultimate Gift Cards For WooCommerce < 3.2.10 - Unauthenticated Gift Card Value Inflation via Discounted Purchase

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkout, allowing unauthenticated users to obtain store credit worth more than they paid...

CVE-2026-19840 Notiqoo < 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX Actions

The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo...

WordPress Ultimate Gift Cards for WooCommerce plugin < 3.2.10 - Unauthenticated Gift Card Value Inflation vulnerability

Unauthenticated Gift Card Value Inflation vulnerability discovered by Guillermo Álvarez Fernández in WordPress Plugin Ultimate Gift Cards For WooCommerce versions 3.2.10...

WordPress Notiqoo plugin < 1.4.14 - Contributor+ Arbitrary Option Update vulnerability

Contributor+ Arbitrary Option Update vulnerability discovered by Seongwon Lee in WordPress Plugin Notiqoo – Order Notification & Customer Chat for WooCommerce versions 1.4.14...

CVE-2026-19840 Notiqoo < 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX Actions

The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo...

CVE-2026-19840

The Notiqoo WordPress plugin (specifically the Order Notification & Customer Chat for WooCommerce plugin) versions before 1.4.14 is vulnerable to an incorrect authorization flaw. The plugin fails to perform adequate capability checks on several of its AJAX actions and constructs the name of the o...

CVE-2026-85645 Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Reflected Cross-Site Scripting

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulkaction parameter in all versions up to, and including, 1.15.46 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-85645 Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Reflected Cross-Site Scripting

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulkaction parameter in all versions up to, and including, 1.15.46 due to insufficient input sanitization and output escaping. This makes it...

EUVD-2026-75254

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulkaction parameter in all versions up to, and including, 1.15.46 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-85645

The Form Maker by 10Web WordPress plugin (versions ≤ 1.15.46 ) is vulnerable to Reflected Cross-Site Scripting via the bulk_action parameter, caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary scripts into pages if a user clicks a crafted...

CVE-2026-76562

The Sidebar Manager Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sbmdescription' parameter in all versions up to, and including, 1.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-4657

The Easy Google Fonts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the controlselectors meta field in all versions up to, and including, 2.0.4. This is due to the plugin registering the controlselectors meta field with showinrest enabled but without a sanitizecallback, an...