CVE-2026-105198

The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced by an order-item identifier before rendering that order's confirmation summary, letting an unauthenticated visitor retrieve any customer's name, contact details and order...

CVE-2026-5769

A vulnerability exists in Brocade SANnav versions prior to 3.0.1 where the Brocade Fabric OS switch admin password may be captured in plaintext within a memory swap file. This occurs when the SANnav server experiences an Out Of Memory (OOM) condition. An authenticated admin user with access to th...

EUVD-2026-94755

A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS switch admin password captured in plaintext within a memory swap file on the server hosting the Brocade SANnav Virtual Machine VM. This can happen when the SANnav server encounters an Out Of Memory OOM condition. The...

CVE-2026-94275

The Track Orders for WooCommerce WordPress plugin (versions before 1.2.7 ) contains an unauthenticated PII disclosure vulnerability. The root cause is a failure to verify order ownership before returning billing details. An unauthenticated attacker can obtain sensitive information, including a cu...

CVE-2026-94258

The SMS Alert WordPress plugin versions 3.6.4 through 4.0.0 contains a vulnerability where it fails to verify if an acting administrator has permission to manage specific users before returning their stored billing phone numbers. This flaw allows an administrator of one site on a multisite networ...

WordPress SMS Alert plugin 3.6.4-4.0.0 - Admin+ Network User Billing Phone Disclosure vulnerability

Admin+ Network User Billing Phone Disclosure vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin SMS Alert Order Notifications versions 3.6.4-4.0.0...

CVE-2026-94275 Track Orders for WooCommerce < 1.2.7 - Unauthenticated PII Disclosure via 'email' Parameter

The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, allowing unauthenticated attackers to obtain a customer's name, email address, phone number, postal address and order history by supplying that customer's ema...

EUVD-2026-94753

The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbers, allowing an administrator of one site on a multisite network to disclose the phone numbers of users who belong to...

EUVD-2026-94754

The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, allowing unauthenticated attackers to obtain a customer's name, email address, phone number, postal address and order history by supplying that customer's ema...

CVE-2026-94258 SMS Alert 3.6.4 - 4.0.0 - Admin+ Network User Billing Phone Disclosure via Bulk User Actions

The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbers, allowing an administrator of one site on a multisite network to disclose the phone numbers of users who belong to...

CVE-2026-94244 Wallet System for WooCommerce < 2.8.0 - Subscriber+ Store-Wide Wallet Transaction Disclosure via Export

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain from a front-end page, before generating a report containing every customer's wallet transaction history, allowing any authenticated user,...

CVE-2026-94244

The Wallet System for WooCommerce WordPress plugin, in versions before 2.8.0 , is vulnerable to a store-wide wallet transaction disclosure. The root cause is a lack of capability checks where the plugin relies on a token obtainable by any authenticated user from a front-end page to generate repor...

EUVD-2026-94750

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain from a front-end page, before generating a report containing every customer's wallet transaction history, allowing any authenticated user,...

WordPress Wallet System for WooCommerce plugin < 2.8.0 - Subscriber+ Store-Wide Wallet Transaction Disclosure vulnerability

Subscriber+ Store-Wide Wallet Transaction Disclosure vulnerability discovered by Sanyam Jain, Astra Security in WordPress Plugin Wallet System for WooCommerce versions 2.8.0...

CVE-2026-105196

The LatePoint (Appointment Booking Plugin) for WordPress versions prior to 5.6.9 is vulnerable to a cross-agent data disclosure and modification flaw. The root cause is a failure to enforce per-record authorization on several AI Abilities API actions. An authenticated user with the LatePoint Agen...

CVE-2026-105198

The LatePoint (Appointment Booking Plugin) for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) flaw in versions before 5.7.3 . The root cause is a failure to verify that a caller owns the order referenced by an order-item identifier before rendering the confirmation summary....

WordPress Appointment Booking Plugin plugin < 5.7.3 - Unauthenticated Customer PII Disclosure vulnerability

Unauthenticated Customer PII Disclosure vulnerability discovered by Vũ Quang Huy in WordPress Plugin LatePoint versions 5.7.3...

CVE-2026-86826 BackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Working Directory on NGINX

The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive database dump and site...

EUVD-2026-94747

The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive database dump and site...

CVE-2026-86826

The BackWPup WordPress plugin, in versions before 5.7.7 , fails to properly restrict web access to the working directory utilized during backup restores. On webservers that do not honor .htaccess rules, such as NGINX , unauthenticated attackers can download full backup archives left behind by int...