CVE-2025-69332: Missing Authorization

Subscriber Broken Access Control in Bookify = 1.1.1 versions...

CVE-2026-52700: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in WCMultiShipping = 3.0.2 versions...

CVE-2026-52697: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Taskbuilder = 5.0.7 versions...

CVE-2026-49773: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in FV Flowplayer Video Player 7.5.51.7212 versions...

CVE-2026-49082: Insertion of Sensitive Information Into Sent Data

Subscriber Sensitive Data Exposure in Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons = 1.4.8 versions...

CVE-2026-48880: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in WP Job Portal = 2.5.2 versions...

CVE-2026-48870: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in King Addons for Elementor = 51.1.62 versions...

CVE-2026-42659: Missing Authorization

Subscriber Broken Access Control in Advanced Form Integration = 1.126.12 versions...

CVE-2026-42378: Authentication Bypass Using an Alternate Path or Channel

Subscriber Broken Authentication in WP Full Stripe Free = 8.4.1 versions...

CVE-2026-40796: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Subscriber Sensitive Data Exposure in WPPizza = 3.19.9 versions...

CVE-2026-40773: Missing Authorization

Subscriber Broken Access Control in rtMedia for WordPress, BuddyPress and bbPress = 4.7.9 versions...

CVE-2026-40766: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in MasterStudy LMS = 3.7.25 versions...

CVE-2026-39594: Missing Authorization

Subscriber Broken Access Control in Ultra Addons for WPForms = 1.0.11 versions...

CVE-2026-39527: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in WpStream 4.11.2 versions...

CVE-2026-39491: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in JupiterX Core = 4.14.1 versions...

CVE-2026-40795: Missing Authorization

Subscriber Broken Access Control in Amelia = 2.2 versions...

CVE-2026-39450: Authentication Bypass Using an Alternate Path or Channel

Subscriber Broken Authentication in FunnelKit Automations = 3.7.3 versions...

CVE-2026-42651: Missing Authorization

Subscriber Broken Access Control in Classified Listing = 5.3.9 versions...

CVE-2026-48969: Missing Authorization

Subscriber Broken Access Control in Really Simple SSL = 9.5.9 versions...

CVE-2026-11616

The Events Calendar for GeoDirectory plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.3.28. This is due to the ajaxayiaction handler only applying striptagsescsql — with no allow-list — to the attacker-controlled $POST'type' and $POST'postid' values...