EUVD-2026-62341

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utmcampaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-15780

CVE-2026-15780 is an unauthenticated Stored Cross-Site Scripting vulnerability in the WP Statistics WordPress plugin (all versions ≤ 14.16.8). The root cause is insufficient input sanitization and output escaping of the utm_campaign parameter. Attackers can plant a malicious payload without authe...

CVE-2026-15780 WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utmcampaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-15780 WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utmcampaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-19709

The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...

CVE-2026-19406

The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses...

CVE-2026-14826

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including...

CVE-2026-19709

The Membership For WooCommerce WordPress plugin (versions before 3.1.2 ) is vulnerable to an unauthenticated member data disclosure. The root cause is a failure to verify if an API consumer secret has actually been generated before comparing it against a value supplied in a request. On sites wher...

CVE-2026-19709 Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass

The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...

CVE-2026-19709 Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass

The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...

EUVD-2026-62291

The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...

CVE-2026-19406 Easy Appointments < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appointments Listing

The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses...

CVE-2026-19406

The Easy Appointments WordPress plugin (versions before 4.0.1 ) contains a sensitive information disclosure vulnerability. The root cause is a failure to restrict one of its appointment-listing REST endpoints to records belonging only to the requesting user. Consequently, users with contributor-l...

EUVD-2026-62288

The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses...

CVE-2026-19406 Easy Appointments < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appointments Listing

The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses...

CVE-2026-14826 Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including...

CVE-2026-14826

The Quiz and Survey Master (QSM) WordPress plugin versions before 11.2.4 is vulnerable to an IDOR (Insecure Direct Object Reference) flaw. The plugin fails to perform per-object ownership checks on specific REST routes that return a quiz's email-notification and results-page configurations. This ...

EUVD-2026-62266

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including...

PT-2026-78782

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions 10.4 through 10.4.1 Description An unauthenticated user can retrieve information from Edge Processor pipeline configurations when the Edge Processor is enabled. This occurs because the Edge Processor service REST API...

PT-2026-78280

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including...