CVE-2023-6985

CVE-2023-6985 10Web AI Assistant – AI content writing assistant = 1.0.18 - Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation/Activation Description Description The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized...

WordPress Wallet System for WooCommerce plugin < 2.8.0 - Subscriber+ Forged Wallet Withdrawal Request vulnerability

Subscriber+ Forged Wallet Withdrawal Request vulnerability discovered by Mytears in WordPress Plugin Wallet System for WooCommerce versions 2.8.0...

CVE-2026-93509

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint...

CVE-2026-93509 Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Wallet Balance Manipulation via Negative Transfer Amount

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint...

EUVD-2026-94830

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint...

CVE-2026-93509

The Wallet System for WooCommerce WordPress plugin (versions 2.0.0 - 2.7.10 ) is vulnerable to a wallet balance manipulation flaw. The root cause is a failure to validate that transfer amounts are positive, combined with the system computing the sender's new balance from a stale snapshot taken be...

CVE-2026-105194

The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with subscriber-level access to view other customers' recent order products and obtain signed download links that grant access to paid digital files without purchase...

CVE-2026-94244 Wallet System for WooCommerce < 2.8.0 - Subscriber+ Store-Wide Wallet Transaction Disclosure via Export

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain from a front-end page, before generating a report containing every customer's wallet transaction history, allowing any authenticated user,...

CVE-2026-94244

The Wallet System for WooCommerce WordPress plugin, in versions before 2.8.0 , is vulnerable to a store-wide wallet transaction disclosure. The root cause is a lack of capability checks where the plugin relies on a token obtainable by any authenticated user from a front-end page to generate repor...

CVE-2026-105194 Easy Digital Downloads < 3.7.1 - Subscriber+ Sensitive Information Disclosure via User Downloads Block

The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with subscriber-level access to view other customers' recent order products and obtain signed download links that grant access to paid digital files without purchase...

EUVD-2026-94766

The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with subscriber-level access to view other customers' recent order products and obtain signed download links that grant access to paid digital files without purchase...

CVE-2026-82627

The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.6.1.1 via deserialization of untrusted input. This makes it possible for authenticated...

CVE-2026-82627 Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included <= 7.6.1.1 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion

The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.6.1.1 via deserialization of untrusted input. This makes it possible for authenticated...

EUVD-2026-94658

The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.6.1.1 via deserialization of untrusted input. This makes it possible for authenticated...

EUVD-2026-94652

The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the processstepcustomer function using isuserloggedin as the sole gate before merging POSTed customer data into an...

PT-2026-107833

The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with subscriber-level access to view other customers' recent order products and obtain signed download links that grant access to paid digital files without purchase...

PT-2026-107808

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the upload files function. This is due to missing file type validation in the upload files function, which reads and applies an...

PT-2026-107767

The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.6.1.1 via deserialization of untrusted input. This makes it possible for authenticated...

CVE-2026-17538

The LatePoint - Appointment Booking & Reservation plugin for WordPress (versions

CVE-2026-104651 Yaad Sarig Payment Gateway For WC < 2.2.13 - Subscriber+ Arbitrary Order Payment Manipulation via IDOR

The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to...