CVE-2026-13604

The Pixelavo WordPress plugin before 1.5.4 registers an unauthenticated AJAX action, gated only by a nonce that it emits publicly on every front-end page, that forwards client-supplied event data to the configured Facebook Conversions API using the administrator's stored access token. This allows...

CVE-2026-13596

The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-12966

The Direct Payments for WooCommerce WordPress plugin before 2.5.3 does not verify that the requester owns the targeted WooCommerce order in several unauthenticated AJAX handlers before changing its status and overwriting its payment metadata, allowing unauthenticated attackers to tamper with othe...

CVE-2026-14839 Mapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure

The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished draft, pending, private, and...

CVE-2026-14839

CVE-2026-14839 affects Mapster WP Maps WordPress plugin (

CVE-2026-14839 Mapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure

The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished draft, pending, private, and...

CVE-2026-14839

The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished draft, pending, private, and...

CVE-2026-14840

CVE-2026-14840 affects the YOP Poll WordPress plugin prior to 7.0.6. The root cause is that the plugin does not validate the connection’s origin IP and trusts client-controlled forwarding headers when enforcing per-IP vote restrictions, enabling unauthenticated attackers to bypass the vote limit ...

EUVD-2026-51711

The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished draft, pending, private, and...

CVE-2026-14822 Event Tickets < 5.29.0.1 - Unauthenticated PayPal Order Status Manipulation

The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders...

CVE-2026-14315 Pixel Tag Manager for WooCommerce < 2.2.1 - Unauthenticated Forged Conversion Event Submission

The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.1 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to submit forged e-commerce conversion events to the site's configured server-side advertising conversion APIs using the site's...

CVE-2026-14561

The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered...

CVE-2026-14315

The Pixel Tag Manager for WooCommerce WordPress plugin is vulnerable in versions before 2.2.1 due to missing authorization on one AJAX action. This allows unauthenticated users to submit forged e-commerce conversion events to the site’s configured server‑side advertising conversion APIs using sto...

CVE-2026-14822

The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders...

CVE-2026-14561

The CVE-2026-14561 entry concerns the Authora WordPress plugin (versions before 1.7.7). The vulnerability arises because the plugin does not keep the one-time login code confidential, returning the OTP and a valid verification token in the response of an unauthenticated action. This allows unauth...

CVE-2026-13596

CVE-2026-13596 affects the Participants Database WordPress plugin prior to 2.7.8.4. The root cause is improper sanitization/escaping of a user-supplied parameter used in an SQL query, enabling unauthenticated SQL injection. The vulnerability impacts how the plugin builds a query from the list/sea...

CVE-2026-13604 Pixelavo < 1.5.4 - Unauthenticated Facebook CAPI Event Injection via pixelavo_event AJAX

The Pixelavo WordPress plugin before 1.5.4 registers an unauthenticated AJAX action, gated only by a nonce that it emits publicly on every front-end page, that forwards client-supplied event data to the configured Facebook Conversions API using the administrator's stored access token. This allows...

EUVD-2026-51702

The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against...

CVE-2026-13604

Pixelavo WordPress plugin before 1.5.4 registers an unauthenticated AJAX action gated only by a publicly emitted nonce, forwarding client-supplied event data to the Facebook Conversions API using the administrator’s stored access token. This enables an unauthenticated visitor to inject arbitrary ...

EUVD-2026-51700

The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks...