CVE-2026-40727: Improper Limitation of a Pathname to a Restricted Directory

Sales Representative Arbitrary File Deletion in Groundhogg = 4.4 versions...

CVE-2026-39587: Incorrect Privilege Assignment

Unauthenticated Privilege Escalation in WP BASE Booking = 5.9.0 versions...

CVE-2026-39584: Missing Authorization

Subscriber Broken Access Control in RepairBuddy = 4.1132 versions...

CVE-2026-39579: Incorrect Privilege Assignment

Contributor Privilege Escalation in B Blocks = 2.0.31 versions...

CVE-2026-39534: Missing Authorization

Unauthenticated Broken Access Control in WP Directory Kit = 1.5.0 versions...

CVE-2026-39533: Missing Authorization

Unauthenticated Broken Access Control in AWP Classifieds = 4.4.4 versions...

CVE-2026-39532: Deserialization of Untrusted Data

Contributor PHP Object Injection in Events Calendar for GeoDirectory = 2.3.25 versions...

CVE-2026-39527: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in WpStream 4.11.2 versions...

CVE-2026-39525: Missing Authorization

Unauthenticated Broken Access Control in Booking Activities = 1.16.48.1 versions...

CVE-2026-39524: Missing Authorization

Unauthenticated Broken Access Control in Masteriyo - LMS = 2.1.5 versions...

CVE-2026-39518: Authorization Bypass Through User-Controlled Key

Subscriber Insecure Direct Object References IDOR in EventPrime = 4.3.0.0 versions...

CVE-2026-39515: Missing Authorization

Subscriber Broken Access Control in Motors 1.4.107 versions...

CVE-2026-39513: Missing Authorization

Unauthenticated Broken Access Control in Easy Appointments = 3.12.21 versions...

CVE-2026-39512: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in GeoDirectory = 2.8.152 versions...

CVE-2026-39503: Missing Authorization

Unauthenticated Broken Access Control in Easy Digital Downloads = 3.6.5 versions...

CVE-2026-39493: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Simply Schedule Appointments = 1.6.9.27 versions...

CVE-2026-39498: Deserialization of Untrusted Data

Shop manager PHP Object Injection in YayMail = 4.3.3 versions...

CVE-2026-39492: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in WP Maps = 4.9.1 versions...

CVE-2026-39491: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in JupiterX Core = 4.14.1 versions...

CVE-2026-39474: Deserialization of Untrusted Data

Contributor PHP Object Injection in Post Duplicator = 3.0.10 versions...