CVE-2026-15252 Search Atlas SEO < 2.6.12 - Subscriber+ Google Indexing API Access

The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a capability or nonce check in one of its AJAX handlers, allowing any authenticated user such as a Subscriber to invoke the site's Google Indexing API integration, submitting or removing the site's URLs from Google's index and...

CVE-2026-11782 Points and Rewards for WooCommerce < 2.10.1 - Unauthenticated Arbitrary User Wallet & Points Manipulation via IDOR

The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points update action that is available to unauthenticated users, and does not verify that the requester owns the account being changed, allowing unauthenticated...

CVE-2026-15252

The CVE-2026-15252 entry concerns the Search Atlas SEO WordPress plugin

CVE-2026-15382

The CVE concerns the Ultimate Addons for WPBakery Page Builder WordPress plugin (before version 3.21.4). The vulnerability arises because there is no capability or nonce check when deleting a site’s custom-uploaded icon font packs, allowing an unauthenticated attacker to permanently delete all cu...

EUVD-2026-50999

The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users' form submission data,...

CVE-2026-15257

The CVE concerns the RegistrationMagic WordPress plugin, specifically versions before 6.0.9.4. The affected component is the front-end submission-editing action, where the plugin fails to perform authorization, ownership, or nonce checks. This exposes unauthenticated attackers to overwrite other ...

CVE-2026-15257

The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allowing unauthenticated attackers to overwrite other users' form submissions and the profile fields of the associated non-administrator...

CVE-2026-15257 RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission and User Profile Modification

The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allowing unauthenticated attackers to overwrite other users' form submissions and the profile fields of the associated non-administrator...

EUVD-2026-50998

The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a capability or nonce check in one of its AJAX handlers, allowing any authenticated user such as a Subscriber to invoke the site's Google Indexing API integration, submitting or removing the site's URLs from Google's index and...

CVE-2026-15250 LatePoint < 5.6.8 - Unauthenticated Booking Object Mass Assignment via Public Booking Funnel

The Appointment Booking Plugin WordPress plugin before 5.6.8 does not restrict which booking fields an unauthenticated visitor can set through its public booking funnel, allowing an unauthenticated user to assign a privileged booking field such as the approval status and thereby bypass the site's...

CVE-2026-14318 GiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template Settings

The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor...

CVE-2026-15240 Customer Switching for WooCommerce < 2.1.3 - Customer+ Privilege Escalation to Administrator via Insecure Operator Resolution

The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account,...

EUVD-2026-50997

The Appointment Booking Plugin WordPress plugin before 5.6.8 does not restrict which booking fields an unauthenticated visitor can set through its public booking funnel, allowing an unauthenticated user to assign a privileged booking field such as the approval status and thereby bypass the site's...

EUVD-2026-50995

The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor...

CVE-2026-14231

The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in, allowing any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by...

EUVD-2026-50993

The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course...

CVE-2026-15240

The CVE refers to the Customer Switching for WooCommerce plugin for WordPress, affected in versions before 2.1.3. The root cause is insecure binding of an active user-switching session to the initiating operator, allowing a lower-privilege account that an operator is switched into to be resolved ...

CVE-2026-15250

The CVE-2026-15250 affects the LatePoint Appointment Booking Plugin for WordPress, specifically all versions before 5.6.8. The underlying issue is an unauthenticated mass-assignment flaw where a public booking funnel does not restrict which booking fields an unauthenticated visitor can set, allow...

CVE-2026-14318

Affected product: GiveWP WordPress plugin (before 4.16.3). Vulnerability: The donation-form template setting is not escaped before output into an HTML attribute, enabling stored XSS. Impact (as described): Users with the GiveWP Worker role and above can inject arbitrary web scripts that execute o...

CVE-2026-14207 LifterLMS < 10.0.10 - Instructor+ Stored XSS via Featured Pricing Information

The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course...