CVE-2026-105397: Improper Neutralization of Input During Web Page Generation

LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the updatequestion...

CVE-2026-104446

YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated attackers to send email through the wiki's SMTP server. Attackers can POST an XMLHttpRequest to the mail handler without field or type parameters, supplying arbitrary recipient,...

CVE-2026-104446 YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler

YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated attackers to send email through the wiki's SMTP server. Attackers can POST an XMLHttpRequest to the mail handler without field or type parameters, supplying arbitrary recipient,...

CVE-2026-104446 YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler

YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated attackers to send email through the wiki's SMTP server. Attackers can POST an XMLHttpRequest to the mail handler without field or type parameters, supplying arbitrary recipient,...

CVE-2026-104446

YesWiki versions before 4.6.7 are vulnerable to an authentication bypass in the contact mail AJAX handler. This flaw allows unauthenticated attackers to send emails through the wiki's SMTP server by posting an XMLHttpRequest to the mail handler without required field or type parameters. Attackers...

EUVD-2026-91457

YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated attackers to send email through the wiki's SMTP server. Attackers can POST an XMLHttpRequest to the mail handler without field or type parameters, supplying arbitrary recipient,...

CVE-2026-104446 YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler

YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated attackers to send email through the wiki's SMTP server. Attackers can POST an XMLHttpRequest to the mail handler without field or type parameters, supplying arbitrary recipient,...

CVE-2026-96647

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsdremark' Parameter in all versions up to, and including, 6.1.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-96647 Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lsd[remark]' Parameter

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsdremark' Parameter in all versions up to, and including, 6.1.1 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-91255

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsdremark' Parameter in all versions up to, and including, 6.1.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-90988

The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing unauthenticated users to read the contact records of quote-request submissions, including records the site has not published...

EUVD-2026-91189

The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing unauthenticated users to read the contact records of quote-request submissions, including records the site has not published...

CVE-2026-90988 Request a Quote <= 2.5.6 - Unauthenticated Quote Request Contact Record Disclosure via emd_get_std_pagenum

The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing unauthenticated users to read the contact records of quote-request submissions, including records the site has not published...

CVE-2026-90988

The Request a Quote WordPress plugin in versions through 2.5.6 is vulnerable to unauthenticated contact record disclosure. The root cause is a missing authorization check on an unauthenticated AJAX handler , specifically involving emd_get_std_pagenum. This allows unauthenticated users to read pri...

CVE-2026-90988: Exposure of Sensitive Information to an Unauthorized Actor

The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing unauthenticated users to read the contact records of quote-request submissions, including records the site has not published...

CVE-2026-96647: Improper Neutralization of Input During Web Page Generation

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsdremark' Parameter in all versions up to, and including, 6.1.1 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-104088

Name of the Vulnerable Software and Affected Versions Request a Quote WordPress plugin versions prior to 2.5.7 Description An unauthenticated AJAX handler fails to perform an authorization check, which allows unauthenticated users to read contact records of quote-request submissions. This include...

PT-2026-104256

YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated attackers to send email through the wiki's SMTP server. Attackers can POST an XMLHttpRequest to the mail handler without field or type parameters, supplying arbitrary recipient,...

CVE-2026-104446: Missing Authentication for Critical Function

YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated attackers to send email through the wiki's SMTP server. Attackers can POST an XMLHttpRequest to the mail handler without field or type parameters, supplying arbitrary recipient,...

CVE-2026-96268

The Awesome Support – WordPress HelpDesk & Support Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 6.4.0 . The root cause is insufficient input sanitization and output escaping of the 'gdpr-data' parameter within the wpas_gdpr_user_opt_o...