EUVD-2026-53033

The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check on the cost-calculator-custom-export-run AJAX action handler CCBExportImport::exportcalculators in all versions up to, and including, 3.6.17. The handler only...

CVE-2026-7753 Cost Calculator Builder <= 3.6.17 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure

The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check on the cost-calculator-custom-export-run AJAX action handler CCBExportImport::exportcalculators in all versions up to, and including, 3.6.17. The handler only...

CVE-2026-7753

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-15230: Improper Access Control

The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its REST API routes, relying only on a shared nonce, allowing any authenticated user such as a subscriber to overwrite the store's pricing configuration and to disclose private coupon codes...

CVE-2026-7753: Missing Authorization

The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check on the cost-calculator-custom-export-run AJAX action handler CCBExportImport::exportcalculators in all versions up to, and including, 3.6.17. The handler only...

CVE-2026-15281: Improper Neutralization of Special Elements used in an SQL Command

The User Access Manager plugin for WordPress is vulnerable to Second-Order SQL Injection via the 'id' parameter of the wpajaxsave-attachment-compat AJAX action in versions up to, and including, 2.3.12. This is due to insufficient validation on the objectId value stored in the saveAjaxAttachmentDa...

PT-2026-67966

Name of the Vulnerable Software and Affected Versions Football Pool plugin for WordPress versions prior to 2.13.5 Description Reflected Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce check, the shouttext...

CVE-2026-8790: Improper Neutralization of Input During Web Page Generation

The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the shouttext POST parameter of the Shoutbox widget in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce...

PT-2026-68083

Name of the Vulnerable Software and Affected Versions MailChimp Forms by MailMunch versions prior to 3.2.8 Description The plugin is susceptible to unauthorized data modification because the sign in and sign up AJAX handlers lack proper capability checks. Authenticated users with Subscriber-level...

CVE-2026-7456: Missing Authorization

The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxdisconnect function in all versions up to, and including, 3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete...

WordPress Academy LMS plugin <= 3.8.2 - Subscriber+ Sensitive Information Disclosure vulnerability

Subscriber+ Sensitive Information Disclosure vulnerability discovered by Stefan Spasic in WordPress Plugin Academy LMS versions = 3.8.2...

CVE-2026-16056

The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handlers, allowing any authenticated user down to Subscriber to read the site's entire stored OpenAI prompt history...

CVE-2026-14848

The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-subscription checkout belongs to the current user, allowing any authenticated user with Subscriber-level access and above to take over another member's...

CVE-2026-12698

The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account, allowing users with a subscriber-level account to write administrator-controlled account-state and reputation fields on their own profile, including self-activati...

CVE-2026-16295

The Clearfy Cache WordPress plugin, in versions prior to 2.4.3 , is vulnerable to Sensitive Information Disclosure due to a missing capability check in one of its admin-page dispatch paths. This flaw allows any authenticated user, such as a Subscriber , to access and render admin-only settings pa...

CVE-2026-16546 Wired Impact Volunteer Management < 2.8.2 - Subscriber+ Arbitrary RSVP Removal via wivm_remove_rsvp

The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJAX actions, and does not verify that the RSVP being removed belongs to the requesting user, allowing users with a role as low as Subscriber to remove arbitrary users' RSVPs from...

EUVD-2026-52599

The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJAX actions, and does not verify that the RSVP being removed belongs to the requesting user, allowing users with a role as low as Subscriber to remove arbitrary users' RSVPs from...

CVE-2026-16546 Wired Impact Volunteer Management < 2.8.2 - Subscriber+ Arbitrary RSVP Removal via wivm_remove_rsvp

The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJAX actions, and does not verify that the RSVP being removed belongs to the requesting user, allowing users with a role as low as Subscriber to remove arbitrary users' RSVPs from...

WordPress Clearfy Cache plugin < 2.4.3 - Subscriber+ Sensitive Information Disclosure vulnerability

Subscriber+ Sensitive Information Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Clearfy Cache versions 2.4.3...

CVE-2026-16295 Clearfy < 2.4.3 - Subscriber+ Sensitive Information Disclosure via Factory Page-Action Dispatcher

The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical...