CVE-2026-81778

Subscriber Cross Site Scripting XSS in Kalles Addons = 1.0.6 versions...

CVE-2026-81758

Subscriber Broken Access Control in OwnerRez API = 1.2.6 versions...

CVE-2026-81297

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81280

Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders = 4.0.0 versions...

CVE-2026-81287

Subscriber SQL Injection in Charitable = 1.8.12.1 versions...

EUVD-2026-68791

Subscriber Cross Site Scripting XSS in Kalles Addons = 1.0.6 versions...

CVE-2026-81778

CVE-2026-81778 affects the Kalles Addons WordPress plugin in versions 1.0.6 and earlier . The vulnerability is a Cross Site Scripting (XSS) flaw in the plugin's Subscriber functionality. The CVSS v3.1 score is 6.5 (MEDIUM) with a Changed Scope vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L)...

CVE-2026-81778 WordPress Kalles Addons plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Kalles Addons = 1.0.6 versions...

CVE-2026-81762 WordPress Booking and Rental Manager plugin <= 2.7.6 - Broken Access Control vulnerability

Subscriber Broken Access Control in Booking and Rental Manager = 2.7.6 versions...

EUVD-2026-68786

Subscriber Broken Access Control in Booking and Rental Manager = 2.7.6 versions...

CVE-2026-81762

CVE-2026-81762 is a Broken Access Control vulnerability in the Booking and Rental Manager WordPress plugin (for WooCommerce), affecting versions 2.7.6 and earlier . The flaw allows users with the Subscriber role to perform actions they should not be permitted to, resulting in a High integrity imp...

CVE-2026-81758 WordPress OwnerRez API plugin <= 1.2.6 - Broken Access Control vulnerability

Subscriber Broken Access Control in OwnerRez API = 1.2.6 versions...

EUVD-2026-68785

Subscriber Broken Access Control in OwnerRez API = 1.2.6 versions...

CVE-2026-81758

CVE-2026-81758 is a Broken Access Control vulnerability in the WordPress plugin OwnerRez API , affecting versions ≤ 1.2.6 . The flaw allows users with the Subscriber role to perform actions they should not be authorized for, as discovered by JunHee CHO via PatchStack. The CNA-assigned CVSS 3.1 sc...

CVE-2026-81297

Fluent Forms Pro Add On Pack is a WordPress plugin affected by a Subscriber Privilege Escalation vulnerability in versions ≤ 6.2.12 , as discovered by Ananda Dhakal (Patchstack). The CVSS 3.1 score is 7.5 (HIGH) with the vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a network-based attac...

EUVD-2026-68782

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81297 WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack = 6.2.12 versions...

EUVD-2026-68777

Subscriber SQL Injection in Charitable = 1.8.12.1 versions...

CVE-2026-81287 WordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerability

Subscriber SQL Injection in Charitable = 1.8.12.1 versions...

CVE-2026-81287

CVE-2026-81287 affects the WordPress Charitable plugin in versions 1.8.12.1 and earlier , where a subscriber-level SQL injection vulnerability exists. The flaw allows an authenticated subscriber to exploit a SQL injection, with a CVSS 3.1 score of 8.5 (HIGH) . The vector CVSS:3.1/AV:N/AC:L/PR:L/U...