CVE-2026-65490 WordPress Create by Mediavine plugin <= 2.6.0 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in John-Michael L'Allier Create mediavine-create allows Retrieve Embedded Sensitive Data.This issue affects Create: from n/a through 2.6.0...

EUVD-2026-48101

Unauthenticated Sensitive Data Exposure in Create by Mediavine = 2.5.3 versions...

CVE-2026-65474 WordPress Ninja Tables plugin <= 5.2.10 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Ninja Tables = 5.2.10 versions...

CVE-2026-65474

The CVE concerns WordPress Ninja Tables plugin

EUVD-2026-48086

Unauthenticated Sensitive Data Exposure in Ninja Tables = 5.2.10 versions...

CVE-2026-65474 WordPress Ninja Tables plugin <= 5.2.10 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Ninja Tables = 5.2.10 versions...

CVE-2026-65474

Unauthenticated Sensitive Data Exposure in Ninja Tables = 5.2.10 versions...

CVE-2026-65458

CVE-2026-65458 concerns the WordPress Polylang plugin, affected versions

CVE-2026-65458 WordPress Polylang and Polylang Pro plugins <= 3.8.5 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Chouby Polylang and Chouby Polylang Pro allows Retrieve Embedded Sensitive Data. This issue affects Polylang: through 3.8.5; Polylang Pro: through 3.8.5...

CVE-2026-65458 WordPress Polylang and Polylang Pro plugins <= 3.8.5 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Chouby Polylang and Chouby Polylang Pro allows Retrieve Embedded Sensitive Data. This issue affects Polylang: through 3.8.5; Polylang Pro: through 3.8.5...

EUVD-2026-48223

Contributor Sensitive Data Exposure in Polylang = 3.8.5 versions...

CVE-2026-65458

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Chouby Polylang and Chouby Polylang Pro allows Retrieve Embedded Sensitive Data. This issue affects Polylang: through 3.8.5; Polylang Pro: through 3.8.5...

CVE-2026-27372

The CVE concerns WordPress plugin PeproDev Ultimate Invoice (admin URL not needed) for affected versions

CVE-2026-27372 WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice = 2.2.6 versions...

WordPress Ebook Store plugin <= 6.19 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by hivesec in WordPress Plugin Ebook Store versions = 6.19...

WordPress ShipTime: Discounted Shipping Rates plugin <= 1.1.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by VuNBT in WordPress Plugin ShipTime: Discounted Shipping Rates versions = 1.1.1...

EUVD-2026-47905

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tcorderstatusfilter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi...

CVE-2026-65758 Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2

Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions...

CVE-2026-65758 Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2

Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions...

CVE-2026-15906 Premium Packages <= 7.0.4 - Authenticated (Admin+) SQL Injection via 'orderby' Parameter

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...