CVE-2026-16774

The CVE-2026-16774 entry concerns the WordPress Chatbot plugin vulnerable to Missing Authorization via the wpcs_send_email() AJAX handler in versions up to and including 8.5.9. The wpcs_send_email() function is registered for both wp_ajax_wpcs_send_email and wp_ajax_nopriv_wpcs_send_email without...

CVE-2026-3058

The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.28.14 via the seraphaccelapi AJAX action with fn=GetData. This is due to the OnAdminApiGetData function not performing any capability checks. This makes it...

PT-2026-22902

The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.28.14 via the seraph accel api AJAX action with fn=GetData. This is due to the OnAdminApi GetData function not performing any capability checks. This makes it...

CVE-2025-12573

The Bookingor WordPress plugin through 1.0.12 exposes authenticated AJAX actions without capability or nonce checks, allowing low-privileged users to delete Bookingor WordPress plugin through 1.0.12 data...

CVE-2021-24352

The exportdata function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to export a site's redirects...