CVE-2026-49082: Insertion of Sensitive Information Into Sent Data

Subscriber Sensitive Data Exposure in Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons = 1.4.8 versions...

CVE-2026-49070: Missing Authorization

Unauthenticated Broken Access Control in Knit Pay = 9.4.0.0 versions...

CVE-2026-49068: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Subscriber Sensitive Data Exposure in Coupon Affiliates = 7.8.1 versions...

CVE-2026-49067: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Advanced 301 and 302 Redirect = 1.6.9 versions...

CVE-2026-49066: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Unauthenticated Sensitive Data Exposure in Conekta Payment Gateway = 6.0.0 versions...

CVE-2026-49043: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in WP Migrate Lite = 2.7.8 versions...

CVE-2026-49063: Incorrect Privilege Assignment

Unauthenticated Privilege Escalation in Listdom = 5.5.0 versions...

CVE-2026-49056: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Unauthenticated Sensitive Data Exposure in WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels = 4.9.4 versions...

CVE-2026-48887: Missing Authorization

Unauthenticated Broken Access Control in JS Help Desk = 3.0.9 versions...

CVE-2026-48885: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in HollerBox = 2.3.10.1 versions...

CVE-2026-48964: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in ELEX WordPress HelpDesk & Customer Ticketing System = 3.3.6 versions...

CVE-2026-48889: Incorrect Privilege Assignment

Subscriber Privilege Escalation in Amelia = 2.3 versions...

CVE-2026-48882: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in WP Time Slots Booking Form = 1.2.50 versions...

CVE-2026-48880: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in WP Job Portal = 2.5.2 versions...

CVE-2026-48878: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Subscriber Sensitive Data Exposure in Visual Link Preview = 2.4.1 versions...

CVE-2026-48881: Missing Authorization

Unauthenticated Broken Access Control in TrueBooker = 1.1.9 versions...

CVE-2026-48883: Missing Authorization

Unauthenticated Broken Access Control in WPC Product Bundles for WooCommerce = 8.5.3 versions...

CVE-2026-48873: Missing Authorization

Unauthenticated Broken Access Control in Montonio for WooCommerce = 10.1.2 versions...

CVE-2026-48870: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in King Addons for Elementor = 51.1.62 versions...

CVE-2026-48868: Authorization Bypass Through User-Controlled Key

Unauthenticated Insecure Direct Object References IDOR in Simple Shopping Cart = 5.2.9 versions...