WordPress Workeera plugin < 1.0.6 - Subscriber+ Arbitrary File Deletion vulnerability

Subscriber+ Arbitrary File Deletion vulnerability discovered by Artus KG and Shhriyash in WordPress Plugin Workeera versions 1.0.6...

WordPress Workeera plugin < 1.0.6 - Subscriber+ Arbitrary File Upload vulnerability

Subscriber+ Arbitrary File Upload vulnerability discovered by Erwan LR WPScan in WordPress Plugin Workeera versions 1.0.6...

WordPress Salon booking system plugin <= 10.31.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Salon booking system versions = 10.31.1...

CVE-2026-81274

Subscriber Broken Access Control in Ditty = 3.1.67 versions...

CVE-2026-81279

Subscriber Broken Access Control in Push Notification for Post and BuddyPress = 3.20 versions...

CVE-2026-78285

Subscriber SQL Injection in Like Button Rating = 2.6.61 versions...

CVE-2026-80433

Subscriber Sensitive Data Exposure in SureFeedback Client Site = 1.2.12 versions...

CVE-2026-78273

Subscriber Cross Site Scripting XSS in Fluent Boards Pro = 2.0.11 versions...

CVE-2026-32550

Subscriber SQL Injection in Kadence Shop Kit = 3.0.6 versions...

CVE-2026-32564

Subscriber SQL Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

CVE-2026-81274

The WordPress Ditty (News Ticker) plugin (versions

CVE-2026-81274 WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability

Subscriber Broken Access Control in Ditty = 3.1.67 versions...

EUVD-2026-66952

Subscriber Broken Access Control in Ditty = 3.1.67 versions...

CVE-2026-80433 WordPress SureFeedback Client Site plugin <= 1.2.12 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in SureFeedback Client Site = 1.2.12 versions...

CVE-2026-80433

SureFeedback Client Site is a WordPress plugin vulnerable to Subscriber-level Sensitive Data Exposure in versions 1.2.12 and below . The CVSS 3.1 score is 7.5 (High) , with a network attack vector requiring no privileges or user interaction, and a high impact on confidentiality but no impact on i...

EUVD-2026-66948

Subscriber Sensitive Data Exposure in SureFeedback Client Site = 1.2.12 versions...

CVE-2026-78285

WordPress Like Button Rating plugin (versions

CVE-2026-78285 WordPress Like Button Rating plugin <= 2.6.61 - SQL Injection vulnerability

Subscriber SQL Injection in Like Button Rating = 2.6.61 versions...

EUVD-2026-66942

Subscriber SQL Injection in Like Button Rating = 2.6.61 versions...

CVE-2026-78273

CVE-2026-78273 affects the Fluent Boards Pro WordPress plugin in versions 2.0.11 and earlier . The vulnerability is a Cross-Site Scripting (XSS) flaw exploitable by a user with subscriber-level privileges. The CVSS 3.1 score is 6.5 (Medium) with a vector of AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, in...