EUVD-2026-64250

The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.4.10.3. This is due to the software allowing users to execute an action that does not properly validate the 'payload' value befo...

EUVD-2026-64249

Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery 4.4.0- An unauthenticated access control bypass exists in JoomGallery's category JSON view. When a gallery category is protected with a password, the HTML view correctly enforces the...

CVE-2026-3424

The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to unauthenticated arbitrary shortcode execution in all versions up to and including 5.4.10.3 . The root cause is improper validation of the payload parameter before passing it to do_shortcode, allowing an...

CVE-2026-66916

JoomGallery (a Joomla extension by joomgalleryfriends.net) versions prior to 4.3.1 contain an unauthenticated access control bypass in its category JSON view. When a gallery category is password-protected, the HTML view correctly enforces the password gate, but the JSON view (format=json) skips t...

CVE-2026-66916 Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0

Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery 4.4.0- An unauthenticated access control bypass exists in JoomGallery's category JSON view. When a gallery category is protected with a password, the HTML view correctly enforces the...

CVE-2026-78003

The Mailgun for WordPress plugin (versions up to and including 2.2.0 ) is vulnerable to Server-Side Request Forgery (SSRF) via path traversal. The root cause is insufficient input validation in the add_list() function, which accepts user-controlled array keys from $_POST['addresses'] and passes t...

EUVD-2026-64242

The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery SSRF via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the addlist function, which accepts user-controlled array keys from $POST'addresses', passes...

CVE-2026-77002

The SmilePass Selfie Login WordPress plugin through 1.0.2 lacks any server-side verification of the identity it is asked to authenticate. This allows unauthenticated users to log in as any registered account, including administrators , effectively granting full site takeover without credentials. ...

CVE-2026-77001

The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin (through version 1.2.0 ) contains an unauthenticated authentication bypass due to missing authentication, authorisation, and nonce checks in a publicly accessible login handler. An unauthenticated attacker can obtain a...

CVE-2026-77000

The WP Social Media Login WordPress plugin (through 1.0.6 ) fails to verify that a social login was actually completed with the identity provider before authenticating a visitor. This allows unauthenticated attackers to log in as any existing user, including administrators , simply by supplying t...

EUVD-2026-64224

The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators...

CVE-2026-76793

The Firebase Authentication WordPress plugin before 1.7.1 contains an authentication bypass that allows unauthenticated account takeover . The plugin fails to verify whether the email address in a Firebase authentication token has been confirmed before matching it to a WordPress account and issui...

CVE-2026-76789

CVE-2026-76789 is an unauthenticated stored XSS in the Slider Hero with Video Background, Animation WordPress plugin, affecting versions before 9.1.3 . Two request handlers (identified as Slider Type Change and Add-Slider handlers) lack authorisation and nonce checks, and a stored setting is outp...

EUVD-2026-64227

The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing unauthenticated users to log in as any registered account, including administrators...

EUVD-2026-64226

The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user,...

EUVD-2026-64223

The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be execute...

CVE-2026-16612

FiboSearch WordPress plugin versions before 1.34.1 contain an information disclosure vulnerability in two unauthenticated AJAX endpoints: the autocomplete search endpoint (dgwt_wcas_ajax_search) and the Details Panel endpoint (dgwt_wcas_result_details) when queried for taxonomy details. The root ...

CVE-2026-16738

The Conekta Payment Gateway WordPress plugin, versions prior to 6.2.2 , fails to verify the authenticity of incoming payment gateway webhook notifications and does not bind the confirmed payment to the targeted order or validate its amount. This allows unauthenticated attackers to mark arbitrary ...

CVE-2026-18052

ManageWP Worker WordPress plugin versions before 4.9.37 contain an authentication bypass vulnerability. The plugin's auto-login mechanism does not bind the target account to the cryptographic signature that authorises the login, and does not prevent replay of an already-used login link. An attack...

EUVD-2026-64217

The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two...