CVE-2026-16149: Improper Privilege Management

The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin's user-enumeration protection, which is enabled by default, hooks the restendpoints filter via secureuserendpoints and...

CVE-2026-18027: Improper Limitation of a Pathname to a Restricted Directory

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.9.8 via the getimagesrcinbase64 function. This makes it possible for authenticated attackers, with...

CVE-2026-76057: Missing Authorization

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an...

CVE-2026-19883: Improper Privilege Management

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...

CVE-2026-76074: Missing Authorization

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an...

CVE-2026-74013: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in eShipper Commerce = 2.16.13 versions...

CVE-2026-73998: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in WP w3all phpBB = 3.0.5 versions...

CVE-2026-73992: Improper Control of Generation of Code

Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...

CVE-2026-66647: Missing Authorization

Subscriber Broken Access Control in Homlisti = 3.1.2 versions...

CVE-2026-66594: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in WordPress Persistent Login = 3.1.0 versions...

CVE-2026-66668

Subscriber SQL Injection in Community by PeepSo = 9.0.5.2 versions...

CVE-2026-19782: Exposure of Sensitive Information to an Unauthorized Actor

The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing any authenticated user, such as a subscriber, to retrieve the email addresses of all registered users...

CVE-2026-32552: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in YITH WooCommerce Membership Premium = 2.33.0 versions...

CVE-2026-73359: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent = 4.3.9 versions...

CVE-2026-73995: Authentication Bypass by Spoofing

Subscriber Broken Authentication in User Registration = 5.2.6 versions...

CVE-2026-74004: Missing Authorization

Subscriber Broken Access Control in Gravity Booster – Styles & Layouts for Gravity Forms = 6.0 versions...

CVE-2026-73404: Missing Authorization

Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...

CVE-2026-32466: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...

CVE-2026-66634: Authorization Bypass Through User-Controlled Key

Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...

CVE-2026-10734

The Infility Global plugin for WordPress is vulnerable to Stored Cross-Site Scripting via /cf7record Log Endpoint in all versions up to, and including, 2.15.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...