CVE-2026-118079

The FV Flowplayer Video Player plugin for WordPress, version 8.3.4 and below , is susceptible to a PHP Object Injection vulnerability. The underlying cause is related to the deserialization of untrusted data (CWE-507). This vulnerability could allow an attacker with high privileges to impact the ...

CVE-2026-118078

The Product Catalog Feed by PixelYourSite WordPress plugin (versions

EUVD-2026-112995

Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite = 3.1.4 versions...

CVE-2026-118074

The Finale Lite WordPress plugin (versions

CVE-2026-116869

The WordPress myPOS Checkout plugin versions

CVE-2026-42701

The YayMail WordPress plugin, specifically versions

CVE-2026-1937

🔴 Vulnerability Overview CVE-2026-1937 — Missing Authorization → Arbitrary Options Update → Privilege Escalation Field| Details ---|--- CVE ID| CVE-2026-1937 Severity| HIGH — CVSS v3.1 Score: 7.2 Vector| CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CNA| Wordfence Researcher| Daniel Basta whizzu —...

CVE-2026-109988

The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fieldssectionfieldsrowcoltype' parameter in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This...

CVE-2026-109381

The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mepgrantshopmanageraccess function hooking userhascap and unconditionally granting manageoptions whenever an attacker-controllable request marker matches — mos...

CVE-2026-109988

The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.1.8 . The root cause is insufficient input sanitization and output escaping within the fields[section][fields][row]...

EUVD-2026-111604

The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fieldssectionfieldsrowcoltype' parameter in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This...

CVE-2026-109988 Product Addons for Woocommerce <= 3.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'type' Field Parameter

The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fieldssectionfieldsrowcoltype' parameter in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This...

CVE-2026-109381 Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter

The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mepgrantshopmanageraccess function hooking userhascap and unconditionally granting manageoptions whenever an attacker-controllable request marker matches — mos...

CVE-2026-109381

The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to and including 5.7.8 . The vulnerability exists in the mep_grant_shop_manager_access() function, which hooks into user_has_cap and unconditionally grants the manage_options capability. This occurs when...

CVE-2026-109381 Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter

The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mepgrantshopmanageraccess function hooking userhascap and unconditionally granting manageoptions whenever an attacker-controllable request marker matches — mos...

PT-2026-127870

The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fieldssectionfieldsrowcoltype' parameter in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This...

PT-2026-127861

The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mep grant shop manager access function hooking user has cap and unconditionally granting manage options whenever an attacker-controllable request marker matche...

WordPress Product Addons for Woocommerce – Product Options with Custom Fields plugin <= 3.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting vulnerability

Authenticated Shop Manager+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Product Addons for Woocommerce versions = 3.1.8...

CVE-2026-62130

Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency = 5.5.8 versions...

CVE-2026-62130 WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.8 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency = 5.5.8 versions...