CVE-2026-40795: Missing Authorization

Subscriber Broken Access Control in Amelia = 2.2 versions...

CVE-2026-40794: Missing Authorization

Subscriber Broken Access Control in myCred = 3.0.3 versions...

CVE-2026-40793: Missing Authorization

Subscriber Broken Access Control in Groundhogg 4.4.1 versions...

CVE-2026-40792: Authorization Bypass Through User-Controlled Key

Subscriber Insecure Direct Object References IDOR in KiviCare = 4.2.1 versions...

CVE-2026-40789: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Amelia = 2.2 versions...

CVE-2026-40787: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Quiz And Survey Master = 11.0.0 versions...

CVE-2026-40785: Authentication Bypass Using an Alternate Path or Channel

Subscriber Broken Authentication in AutomatorWP = 5.6.7 versions...

CVE-2026-40781: Authentication Bypass Using an Alternate Path or Channel

Unauthenticated Broken Authentication in ReviewX = 2.3.6 versions...

CVE-2026-40776: Missing Authorization

Unauthenticated Broken Access Control in WP Event SOlution = 4.1.8 versions...

CVE-2026-40779: Improper Limitation of a Pathname to a Restricted Directory

Contributor Arbitrary File Deletion in Link Library = 7.8.8 versions...

CVE-2026-40775: Missing Authorization

Unauthenticated Broken Access Control in Royal MCP = 1.4.2 versions...

CVE-2026-40774: Missing Authorization

Unauthenticated Broken Access Control in Booking Package = 1.7.06 versions...

CVE-2026-40772: Unrestricted Upload of File with Dangerous Type

Unauthenticated Arbitrary File Upload in GeekyBot = 1.2.2 versions...

CVE-2026-40767: Improper Preservation of Permissions

Unauthenticated Broken Access Control in wpForo Forum 3.0.2 versions...

CVE-2026-40766: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in MasterStudy LMS = 3.7.25 versions...

CVE-2026-40743: Missing Authorization

Unauthenticated Broken Access Control in Tutor LMS = 3.9.7 versions...

CVE-2026-40741: Missing Authorization

Unauthenticated Broken Access Control in Redsys for WooCommerce Light = 7.0.0 versions...

CVE-2026-40727: Improper Limitation of a Pathname to a Restricted Directory

Sales Representative Arbitrary File Deletion in Groundhogg = 4.4 versions...

CVE-2026-39587: Incorrect Privilege Assignment

Unauthenticated Privilege Escalation in WP BASE Booking = 5.9.0 versions...

CVE-2026-39584: Missing Authorization

Subscriber Broken Access Control in RepairBuddy = 4.1132 versions...