CVE-2026-86448

The LearnPress WordPress plugin (versions 4.3.2.8 through 4.4.6 ) is vulnerable to an unauthenticated order data disclosure. The root cause is a lack of authentication, capability, or nonce checks before serving previously generated order export files via the lp_download_order function. An unauth...

EUVD-2026-80203

The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file, allowing unauthenticated attackers who can determine its identifier to download customer names, purchases, amounts and guest email...

WordPress WP Import Export Lite plugin < 3.9.33 - Authenticated SQLi vulnerability

Authenticated SQLi vulnerability discovered by mak3breadMinseong Kim in WordPress Plugin WP Import Export Lite versions 3.9.33...

CVE-2026-76559 WP Import Export Lite < 3.9.33 - Admin+ SSRF via Import URL Handling

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their...

CVE-2026-76558 WP Import Export Lite < 3.9.33 - Contributor+ Stored DOM XSS via Custom Field Names

The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the...

WordPress WP Import Export Lite plugin < 3.9.33 - Authenticated Sensitive File Disclosure vulnerability

Authenticated Sensitive File Disclosure vulnerability discovered by Hasyros in WordPress Plugin WP Import Export Lite versions 3.9.33...

EUVD-2026-80179

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allowing any user whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import...

CVE-2026-76558 WP Import Export Lite < 3.9.33 - Contributor+ Stored DOM XSS via Custom Field Names

The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the...

CVE-2026-76556

The WP Import Export Lite WordPress plugin, in versions prior to 3.9.33 , is vulnerable to SQL injection due to the improper sanitization and escaping of certain export filter values before they are utilized in SQL statements. This flaw allows authenticated users with export permissions—which inc...

CVE-2026-76557

The WP Import Export Lite WordPress plugin versions prior to 3.9.33 is vulnerable to an authenticated SQL injection attack. The root cause is the insufficient sanitization and escaping of certain import configuration values before they are utilized in SQL statements. This flaw allows users, who h...

WordPress WP Import Export Lite plugin < 3.9.33 - Authenticated SQLi vulnerability

Authenticated SQLi vulnerability discovered by mak3breadMinseong Kim in WordPress Plugin WP Import Export Lite versions 3.9.33...

WordPress WP Import Export Lite plugin < 3.9.33 - Contributor+ Stored DOM XSS vulnerability

Contributor+ Stored DOM XSS vulnerability discovered by mak3breadMinseong Kim in WordPress Plugin WP Import Export Lite versions 3.9.33...

CVE-2026-76556 WP Import Export Lite < 3.9.33 - Authenticated SQLi via Export Filter Rules

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission, which administrators have by default and may also grant to lower roles, to perform SQL...

CVE-2026-76557 WP Import Export Lite < 3.9.33 - Authenticated SQLi via Import Options

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission ...

EUVD-2026-80181

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission ...

CVE-2026-76555 WP Import Export Lite < 3.9.33 - Authenticated Sensitive File Disclosure via Existing File Import Path Traversal

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allowing any user whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import...

CVE-2026-76558

The WP Import Export Lite WordPress plugin versions before 3.9.33 is vulnerable to a Stored DOM XSS vulnerability. The issue stems from the failure to escape custom field names retrieved from the database before they are inserted into the DOM of an administration screen. This allows users with a ...

CVE-2026-76559

The WP Import Export Lite WordPress plugin, in versions prior to 3.9.33 , is vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is the failure to properly validate URLs during the import process , allowing users with the import capability (such as administrators) to force the sit...

CVE-2026-76555

The WP Import Export Lite WordPress plugin (versions before 3.9.33 ) is vulnerable to authenticated sensitive file disclosure via a path traversal flaw. The plugin fails to validate user-supplied file paths before reading and copying them into a publicly accessible directory. This allows any user...

WordPress WP Import Export Lite plugin < 3.9.33 - Admin+ SSRF vulnerability

Admin+ SSRF vulnerability discovered by Yassin Mohamed in WordPress Plugin WP Import Export Lite versions 3.9.33...