EUVD-2026-39954

The Spexo theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the activateplugin function in all versions up to, and including, 2.0.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate a limited set o...

CVE-2026-11987: Authorization Bypass Through User-Controlled Key

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.4 via the 'id' parameter due to missing validation on a user controlled key. This...

CVE-2026-12471: Missing Authorization

The Spexo theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the activateplugin function in all versions up to, and including, 2.0.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate a limited set o...

CVE-2026-3462: Missing Authorization

The Frisbii Pay plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'uploadcsv' and 'processbatch' functions in all versions up to, and including, 1.8.9. This makes it possible for authenticated attackers, with Subscriber-level access an...

CVE-2026-57627: Server-Side Request Forgery (SSRF)

Subscriber Server Side Request Forgery SSRF in Kirki = 6.0.11 versions...

CVE-2026-57316: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Subscriber Sensitive Data Exposure in GetGenie = 4.4.2 versions...

CVE-2026-56059: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in Travel Booking = 2.2.5 versions...

CVE-2026-56046: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in ListingPro = 2.9.11 versions...

CVE-2025-63078: Missing Authorization

Subscriber Broken Access Control in Restaurant Menu by MotoPress = 2.4.11 versions...

CVE-2026-56026: Server-Side Request Forgery (SSRF)

Subscriber Server Side Request Forgery SSRF in utm.codes = 1.9.0 versions...

CVE-2026-57661: Missing Authorization

Subscriber Broken Access Control in WPComplete = 2.9.5.5 versions...

CVE-2026-57640: Missing Authorization

Subscriber Broken Access Control in MasterStudy LMS = 3.7.30 versions...

CVE-2026-56010: Incorrect Privilege Assignment

Subscriber Privilege Escalation in Abandoned Cart Pro for WooCommerce = 10.4.0 versions...

CVE-2026-57632: Missing Authorization

Subscriber Broken Access Control in Email Marketing for WooCommerce by Omnisend = 1.19.0 versions...

CVE-2026-2508 Gravity Forms Booking <= 2.7.1 - Authenticated (Subscriber+) Time-Based SQL Injection via 'staff_id'

The Gravity Forms Booking plugin for WordPress is vulnerable to time-based SQL Injection via the ‘staffid’ parameter in all versions up to, and including, 2.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-12079 Dokan Pro <= 5.0.4 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter

The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ’orderby’ parameter in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-54822: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in SALESmanago & Leadoo = 3.11.2 versions...

CVE-2026-12079: Improper Neutralization of Special Elements used in an SQL Command

The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ’orderby’ parameter in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-2508: Improper Neutralization of Special Elements used in an SQL Command

The Gravity Forms Booking plugin for WordPress is vulnerable to time-based SQL Injection via the ‘staffid’ parameter in all versions up to, and including, 2.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-9619: Missing Authorization

The Reviews and Rating – Docplanner plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...