CVE-2026-6933: Unrestricted Upload of File with Dangerous Type

The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in versions up to and including 2.0. This is due to the 'generatePluginHandler' function lacking any authorization check before processing user-supplied POST data, combined with the...

CVE-2026-8443: Improper Neutralization of Special Elements used in an SQL Command

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wpprogetoverallchartdata AJAX action in versions up to, and including, 12.6.8. This is due to the use of stripslashes on user-supplied JSON strings prior to jsondecode,...

CVE-2026-8444: Improper Neutralization of Special Elements used in an SQL Command

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs' parameter of the wpfbfindreviews AJAX action in versions up to, and including, 12.6.8. This is due to the handler reading $POST'curselrevs' raw with no sanitization or type casting, then concatenatin...

CVE-2016-20070 WordPress Booking Calendar Contact Form 1.0.23 Privilege Escalation Stored XSS

WordPress Booking Calendar Contact Form 1.0.23 contains privilege escalation and stored cross-site scripting vulnerabilities that allow authenticated users to modify plugin options and inject malicious scripts by failing to verify user privileges and sanitize input parameters. Attackers with...

CVE-2026-49766: Improper Limitation of a Pathname to a Restricted Directory

Subscriber Arbitrary File Deletion in WP User Manager = 2.9.16 versions...

CVE-2026-52697: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Taskbuilder = 5.0.7 versions...

CVE-2025-69332: Missing Authorization

Subscriber Broken Access Control in Bookify = 1.1.1 versions...

CVE-2026-48880: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in WP Job Portal = 2.5.2 versions...

CVE-2026-42659: Missing Authorization

Subscriber Broken Access Control in Advanced Form Integration = 1.126.12 versions...

CVE-2026-48882: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in WP Time Slots Booking Form = 1.2.50 versions...

CVE-2026-48870: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in King Addons for Elementor = 51.1.62 versions...

CVE-2026-42651: Missing Authorization

Subscriber Broken Access Control in Classified Listing = 5.3.9 versions...

CVE-2026-49773: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in FV Flowplayer Video Player 7.5.51.7212 versions...

CVE-2026-49082: Insertion of Sensitive Information Into Sent Data

Subscriber Sensitive Data Exposure in Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons = 1.4.8 versions...

CVE-2026-48969: Missing Authorization

Subscriber Broken Access Control in Really Simple SSL = 9.5.9 versions...

CVE-2026-42378: Authentication Bypass Using an Alternate Path or Channel

Subscriber Broken Authentication in WP Full Stripe Free = 8.4.1 versions...

CVE-2026-40788: Missing Authorization

Subscriber Broken Access Control in ChatBot = 7.9.7 versions...

CVE-2026-39594: Missing Authorization

Subscriber Broken Access Control in Ultra Addons for WPForms = 1.0.11 versions...

CVE-2026-41556: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in ProfilePress = 4.16.13 versions...

CVE-2026-40773: Missing Authorization

Subscriber Broken Access Control in rtMedia for WordPress, BuddyPress and bbPress = 4.7.9 versions...