CVE-2026-15993: Improper Neutralization of Special Elements used in an SQL Command

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via 'username' Placeholder in Dynamic-Choice Field WHERE Clause in all versions up to, and including, 1.15.44 due to insufficient escaping on the user supplied...

CVE-2026-66430

Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.10 versions...

CVE-2026-66654 WordPress Vehica Core plugin <= 1.0.104 - Server Side Request Forgery (SSRF) vulnerability

Subscriber Server Side Request Forgery SSRF in Vehica Core = 1.0.104 versions...

CVE-2026-66430: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.10 versions...

CVE-2026-66661: Incorrect Privilege Assignment

Subscriber Privilege Escalation in Directories Pro = 2.0.5 versions...

CVE-2026-66446: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in If-So Dynamic Content Personalization = 1.10 versions...

CVE-2026-28184: Undefined Security Weakness

Subscriber SQL Injection in Form Maker by 10Web = 1.15.44 versions...

CVE-2026-28181: Missing Authorization

Subscriber Broken Access Control in AcyMailing SMTP Newsletter = 10.11.1 versions...

CVE-2026-28159: Missing Authorization

Subscriber Broken Access Control in Service Finder Booking = 6.2 versions...

CVE-2026-28157: Path Traversal: '.../...//'

Subscriber Path Traversal in Do Lasso = 358 versions...

CVE-2026-28156: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Do Lasso = 358 versions...

CVE-2026-66654: Server-Side Request Forgery (SSRF)

Subscriber Server Side Request Forgery SSRF in Vehica Core = 1.0.104 versions...

CVE-2026-65582: Improper Limitation of a Pathname to a Restricted Directory

Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...

CVE-2026-66693: Missing Authorization

Subscriber Broken Access Control in Motors = 1.4.113 versions...

CVE-2026-28186: Missing Authorization

Subscriber Broken Access Control in Travelfic Toolkit = 1.5.1 versions...

CVE-2026-28161: Incorrect Privilege Assignment

Subscriber Privilege Escalation in Service Finder Booking = 6.2 versions...

CVE-2026-18943: Exposure of Sensitive Information to an Unauthorized Actor

The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscriber to read arbitrary user, post and term metadata, including data belonging to administrators...

CVE-2026-18962: Authorization Bypass Through User-Controlled Key

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the...

CVE-2026-14858: Authorization Bypass Through User-Controlled Key

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store...

CVE-2026-19091

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleterevision function in all versions up to, and including, 2.8.169. This makes it possible for...