CVE-2026-14279: Improper Privilege Management

The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the cedwholesalerequestsend AJAX action. The cedwholesalerequestsendcallback handler only verifies a nonce which is exposed to any authenticated user through wplocalizescrip...

CVE-2026-13360: Improper Neutralization of Input During Web Page Generation

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regionArray' parameter in all versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15142: Improper Privilege Management

The Real Estate Manager Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 12.8.6. This is due to improper capability handling in the allowattachmentactions function, which can treat a target user ID as a media attachment ID during user capability...

CVE-2026-66430

Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.10 versions...

CVE-2026-66654 WordPress Vehica Core plugin <= 1.0.104 - Server Side Request Forgery (SSRF) vulnerability

Subscriber Server Side Request Forgery SSRF in Vehica Core = 1.0.104 versions...

CVE-2026-28186: Missing Authorization

Subscriber Broken Access Control in Travelfic Toolkit = 1.5.1 versions...

CVE-2026-28157: Path Traversal: '.../...//'

Subscriber Path Traversal in Do Lasso = 358 versions...

CVE-2026-28159: Missing Authorization

Subscriber Broken Access Control in Service Finder Booking = 6.2 versions...

CVE-2026-66430: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.10 versions...

CVE-2026-66693: Missing Authorization

Subscriber Broken Access Control in Motors = 1.4.113 versions...

CVE-2026-66661: Incorrect Privilege Assignment

Subscriber Privilege Escalation in Directories Pro = 2.0.5 versions...

CVE-2026-65582: Improper Limitation of a Pathname to a Restricted Directory

Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...

CVE-2026-66446: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in If-So Dynamic Content Personalization = 1.10 versions...

CVE-2026-28181: Missing Authorization

Subscriber Broken Access Control in AcyMailing SMTP Newsletter = 10.11.1 versions...

CVE-2026-28184: Undefined Security Weakness

Subscriber SQL Injection in Form Maker by 10Web = 1.15.44 versions...

CVE-2026-66654: Server-Side Request Forgery (SSRF)

Subscriber Server Side Request Forgery SSRF in Vehica Core = 1.0.104 versions...

CVE-2026-28156: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Do Lasso = 358 versions...

CVE-2026-28161: Incorrect Privilege Assignment

Subscriber Privilege Escalation in Service Finder Booking = 6.2 versions...

CVE-2026-18962: Authorization Bypass Through User-Controlled Key

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the...

CVE-2026-14858: Authorization Bypass Through User-Controlled Key

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store...