WordPress Customer Email Verification for WooCommerce plugin <= 2.8.2 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Wordfence PRISM in WordPress Plugin Customer Email Verification for WooCommerce versions = 2.8.2...

EUVD-2026-111613

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'contentctalabel' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-111605

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'contenttitle' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-100175

The Postie plugin for WordPress (all versions up to and including 1.9.87 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists due to insufficient input sanitization and output escaping within the email body URL autolink functionality. Specifically, the ?postie=get-mail endpoint ...

CVE-2026-100175 Postie <= 1.9.87 - Unauthenticated Stored Cross-Site Scripting via Email Body URL Autolink

The Postie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Body URL Autolink in all versions up to, and including, 1.9.87 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

EUVD-2026-111751

The Postie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Body URL Autolink in all versions up to, and including, 1.9.87 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

roundcube-cve-2021-44026

Roundcube CVE-2021-44026, a SQL injection This repository contains a demo exploit for an SQL injection in Roundcube. Disclaimer : This code is intended solely for educational purposes and to assist security teams in identifying vulnerabilities in their Roundcube instances. It should only be used ...

CVE-2026-109236

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the authenticateuserbyemaillink function — hooked on the wp action and triggered by th...

CVE-2026-106647

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration to the form's own document or owner, instead storing it in a site-global namespace keyed only on a non-secret, author-chosen identifier that is exposed in public page sourc...

CVE-2026-105997

The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state, allowing unauthenticated users to make the site send templated verification-code emails to arbitrary recipients...

EUVD-2026-111705

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration to the form's own document or owner, instead storing it in a site-global namespace keyed only on a non-secret, author-chosen identifier that is exposed in public page sourc...

WordPress Booking Package plugin < 1.7.33 - Unauthenticated Verification Email Sending to Arbitrary Recipient vulnerability

Unauthenticated Verification Email Sending to Arbitrary Recipient vulnerability discovered by Pedro Pinho in WordPress Plugin Booking Package versions 1.7.33...

CVE-2025-29471

Stored XSS Vulnerability in Nagios Log Server Privilege Escalation to Admin ▶️ PoC Demo Date: 2025-04-02 Exploit Author: Seth Kraft Vendor Homepage: https://www.nagios.com/ Vendor Changelog: https://www.nagios.com/changelog/log-server Software Link:...

CVE-2026-29780

Path Traversal in Official Example Script Leading to Arbitrary File Write Summary The official example script examples/recursivelyextractattachments.py contains a path traversal vulnerability that allows arbitrary file write outside the intended output directory. Attachment filenames extracted fr...

ninja-forms-brute

Ninja Forms 3.6.8 - Unauthenticated Email Address Disclosure Description The plugin does not delete the temporary files created when exporting submissions, which could allow unauthenticated attackers to download them and get sensitive information such as the email address of users who submitted a...

CVE-2026-109236 Customer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Authentication Bypass via Predictable Email-Verification Token to 'cusomer_email_verify' Parameter

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the authenticateuserbyemaillink function — hooked on the wp action and triggered by th...

CVE-2026-109236

The Customer Email Verification for WooCommerce plugin for WordPress (versions up to and including 2.8.2 ) is vulnerable to an Authentication Bypass via a predictable email-verification token. The root cause is the authenticate_user_by_email_link() function, which lacks capability checks and nonc...

EUVD-2026-111594

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the authenticateuserbyemaillink function — hooked on the wp action and triggered by th...

CVE-2026-109236 Customer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Authentication Bypass via Predictable Email-Verification Token to 'cusomer_email_verify' Parameter

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the authenticateuserbyemaillink function — hooked on the wp action and triggered by th...

CVE-2025-56132-Liquidfiles

CVE-2025-56132 - LiquidFiles User Enumeration POC Vulnerability Description This vulnerability was identified in LiquidFiles version 4.1 and below. When initiating a password reset via the “POST /passwordreset” endpoint, the application responds differently depending on whether the supplied email...