CVE-2026-48867: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Quiz And Survey Master = 11.1.2 versions...

CVE-2026-48836: Improper Control of Generation of Code

Unauthenticated Remote Code Execution RCE in Easy Invoice = 2.1.19 versions...

CVE-2026-45439: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Realtyna Organic IDX plugin = 5.1.0 versions...

CVE-2026-42775: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in AutomatorWP = 5.7.2 versions...

CVE-2026-42752: Expected Behavior Violation

Unauthenticated Bypass Vulnerability in Stripe Payments = 2.0.98 versions...

CVE-2026-42743: Improper Verification of Cryptographic Signature

Unauthenticated Broken Authentication in Masteriyo - LMS = 2.1.8 versions...

CVE-2026-42688: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in Modula Image Gallery = 2.14.23 versions...

CVE-2026-42687: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in EventPrime = 4.3.2.1 versions...

CVE-2026-42667: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Bookly = 27.4 versions...

CVE-2026-42666: Missing Authorization

Unauthenticated Broken Access Control in Salon booking system = 10.30.25 versions...

CVE-2026-42663: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Simple Membership = 4.7.2 versions...

CVE-2026-42662: Authentication Bypass by Spoofing

Unauthenticated Bypass Vulnerability in Event Tickets = 5.27.5 versions...

CVE-2026-42661: Path Traversal: '.../...//'

Custom role Path Traversal in WP Customer Area = 8.3.4 versions...

CVE-2026-42657: Improper Validation of Specified Quantity in Input

Unauthenticated Other Vulnerability Type in Contest Gallery = 28.1.7 versions...

CVE-2026-42656: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in Contest Gallery = 28.1.6 versions...

CVE-2026-42651: Missing Authorization

Subscriber Broken Access Control in Classified Listing = 5.3.9 versions...

CVE-2026-42650: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in AutomatorWP = 5.6.7 versions...

CVE-2026-42640: Missing Authorization

Unauthenticated Broken Access Control in Classified Listing = 5.3.8 versions...

CVE-2026-42411: Authentication Bypass Using an Alternate Path or Channel

Unauthenticated Broken Authentication in CloudSecure WP Security = 1.4.7 versions...

CVE-2026-42381: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Funnel Builder by FunnelKit = 3.15.0.1 versions...