CVE-2026-48969: Missing Authorization

Subscriber Broken Access Control in Really Simple SSL = 9.5.9 versions...

CVE-2026-39530: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in SpeakOut! Email Petitions = 4.6.5 versions...

CVE-2026-48876: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Stop Spammers = 2026.3 versions...

CVE-2026-39451: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WP Google Review Slider = 18.0 versions...

CVE-2026-39434: Deserialization of Untrusted Data

Shop manager PHP Object Injection in CTX Feed = 6.6.26 versions...

CVE-2026-39583: Incorrect Privilege Assignment

Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery = 2.6.62 versions...

CVE-2026-39507: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Social Slider Feed = 2.3.2 versions...

CVE-2026-49768: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Happyforms = 1.26.13 versions...

CVE-2026-42662: Authentication Bypass by Spoofing

Unauthenticated Bypass Vulnerability in Event Tickets = 5.27.5 versions...

CVE-2025-68872: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Eli's WordCents adSense Widget with Analytics = 1.3.03.27 versions...

CVE-2026-39441: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free = 5.3 versions...

CVE-2026-49766: Improper Limitation of a Pathname to a Restricted Directory

Subscriber Arbitrary File Deletion in WP User Manager = 2.9.16 versions...

CVE-2026-40782: Missing Authorization

Unauthenticated Broken Access Control in WPAdverts = 2.3.0 versions...

CVE-2026-48970: Authentication Bypass Using an Alternate Path or Channel

Unauthenticated Broken Authentication in Really Simple SSL = 9.5.10 versions...

CVE-2026-12057: Inclusion of Functionality from Untrusted Control Sphere

When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails to intercept some dangerous interfaces, which allows remote scripts to be loaded, resulting in arbitrary code execution...

CVE-2026-42665: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in WP Data Access = 5.5.70 versions...

CVE-2026-42686: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in EventPrime = 4.3.2.1 versions...

CVE-2025-60175: Server-Side Request Forgery (SSRF)

Administrator Server Side Request Forgery SSRF in PopAd = 1.0.4 versions...

CVE-2026-42659: Missing Authorization

Subscriber Broken Access Control in Advanced Form Integration = 1.126.12 versions...

CVE-2026-48871: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in MW WP Form = 5.1.3 versions...