CVE-2026-66645: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Table Of Contents Block = 1.5.0 versions...

CVE-2026-32474: Unrestricted Upload of File with Dangerous Type

Contributor Arbitrary File Upload in Templatiq = 0.2.5 versions...

CVE-2026-73995: Authentication Bypass by Spoofing

Subscriber Broken Authentication in User Registration = 5.2.6 versions...

CVE-2026-73358: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Affiliates Manager = 2.9.53 versions...

CVE-2026-73355: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Affiliates Manager = 2.9.53 versions...

CVE-2026-73350: Incorrect Privilege Assignment

Unauthenticated Broken Authentication in SupportCandy = 3.5.1 versions...

CVE-2026-73339: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Modern Events Calendar 7.35.0 versions...

CVE-2026-73375: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Ultimate Maps by Supsystic 1.5.0 versions...

CVE-2026-73348: Missing Authorization

Unauthenticated Broken Access Control in GiveWP 4.16.6 versions...

CVE-2026-32464: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Theme Test Drive = 2.9.1 versions...

CVE-2026-66679: Improper Validation of Specified Quantity in Input

Unauthenticated Broken Access Control in Appointment Hour Booking = 1.5.91 versions...

CVE-2026-66667: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Templately = 3.7.1 versions...

CVE-2026-32549: Missing Authorization

Unauthenticated Broken Access Control in ThumbPress 6.5 versions...

CVE-2026-66633: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack 6.2.12 versions...

CVE-2026-32547: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.22 versions...

CVE-2026-28567: Missing Authorization

Unauthenticated Broken Access Control in WP Sort Order = 1.3.5 versions...

CVE-2026-28570: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Vavo Core = 2.3.0 versions...

CVE-2026-73994: Missing Authorization

Unauthenticated Broken Access Control in Charitable = 1.8.11.3 versions...

CVE-2026-68567: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Convert Pro = 1.0.1 versions...

CVE-2026-19447: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Fileorbis Informatics Services Trade Inc. FileOrbis allows Stored XSS. This issue affects FileOrbis: before 16.5...