CVE-2026-57428: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Sprout Clients = 3.2.3 versions...

CVE-2026-57397: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Coaching = 3.9.2 versions...

CVE-2026-57374: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Funnel Kit Funnel Builder PRO = 3.15.0.7 versions...

CVE-2026-57373: Improper Neutralization of Input During Web Page Generation

Customer Cross Site Scripting XSS in Funnel Kit Funnel Builder PRO = 3.15.0.4 versions...

CVE-2026-57370: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.9.1 versions...

CVE-2026-27423: Missing Authorization

Subscriber Broken Access Control in Participants Database = 2.7.8.4 versions...

CVE-2026-27418: Missing Authorization

Unauthenticated Broken Access Control in WP Fast Total Search = 1.81.282 versions...

CVE-2026-27399: Missing Authorization

Unauthenticated Broken Access Control in MarketKing = 2.1.40 versions...

CVE-2026-27392: Missing Authorization

Contributor Broken Access Control in uListing = 2.2.0 versions...

CVE-2026-27391: Missing Authorization

Subscriber Broken Access Control in uListing = 2.2.0 versions...

CVE-2026-27372: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-27355: Missing Authorization

Unauthenticated Broken Access Control in Ditty = 3.1.66 versions...

CVE-2026-27377: Missing Authorization

Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress = 1.0.16 versions...

CVE-2026-25466: Missing Authorization

Unauthenticated Broken Access Control in WP Go Maps = 10.1.04 versions...

CVE-2026-27064: Unrestricted Upload of File with Dangerous Type

Editor Arbitrary File Upload in Mailster = 4.1.17 versions...

CVE-2026-25427: Missing Authorization

Subscriber Broken Access Control in eRoom = 1.7.1 versions...

CVE-2026-25424: Missing Authorization

Contributor Broken Access Control in Mediavine Control Panel = 2.10.10 versions...

CVE-2026-25405: Improper Neutralization of Special Elements used in an SQL Command

Contributor SQL Injection in eRoom = 1.7.1 versions...

CVE-2026-24639: Server-Side Request Forgery (SSRF)

Author Server Side Request Forgery SSRF in Photo Block = 1.7.1 versions...

CVE-2026-24537: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in WP Accessibility Helper WAH = 0.6.6 versions...