CVE-2026-19782

The WPS Bidouille WordPress plugin before 1.33.5 lacks authorization checks on the wps_get_users AJAX action, allowing any authenticated subscriber to retrieve all registered users' email addresses. Upgrade to 1.33.5 or later. No in-the-wild exploitation is reported. See https://wpscan.com/vulner...

EUVD-2026-62284

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records...

CVE-2026-18777

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification emails to the affected customers...

CVE-2026-18466

The WP Maps WordPress plugin (before 4.9.8) lacks a capability check and nonce validation in an AJAX action, allowing authenticated Subscriber-level users to create unlimited autoloaded database options that load on every page request, enabling persistent denial-of-service. Exploitation details a...

EUVD-2026-62282

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification emails to the affected customers...

EUVD-2026-62279

The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve the usernames and email addresses of users holding the WP Directory Kit WordPress plug...

EUVD-2026-62256

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...

CVE-2026-55593

Froxlor versions before 2.3.8 are vulnerable to CSRF: the standalone lib/ajax.php endpoint bypasses centralized validation in lib/init.php, and the editapikey action in Ajax::editApiKey modifies API key allowed_from/valid_until without a CSRF token. An attacker can forge requests via an authentic...

CVE-2026-13424

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via booklyspeedupupdateaddons AJAX action in all versions up to, and including, 27.7 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-13424

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via booklyspeedupupdateaddons AJAX action in all versions up to, and including, 27.7 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-18432

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...

CVE-2026-13167 Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

EUVD-2026-59849

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...

CVE-2026-18432 Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...

CVE-2026-18432

CVE-2026-18432 affects the Frontend Admin by DynamiApps plugin for WordPress (≤ 3.29.9). The flaw stems from ActionUser::conditions_logic() gating the current_user_can('edit_user', $user_id) check behind is_numeric(), so a non-numeric string (e.g., 1one) can bypass authorization when supplied via...

CVE-2026-18432 Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...

PT-2026-73100

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditions logic gates the current user can'edit user', $user id authorization check behind an is numeric test,...

EUVD-2026-59587

The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, allowing unauthenticated users to retrieve the rendered content of unpublished private, draft, pending documents by supplying thei...

CVE-2026-15993

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via 'username' Placeholder in Dynamic-Choice Field WHERE Clause in all versions up to, and including, 1.15.44 due to insufficient escaping on the user supplied...

CVE-2026-15993 Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via 'username' Placeholder in Dynamic-Choice Field WHERE Clause in all versions up to, and including, 1.15.44 due to insufficient escaping on the user supplied...