CVE-2026-9830 BookingPress Pro < 5.7.3 - Unauthenticated Customer PII Disclosure and Booking Tampering via Permission Callback Bug

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other...

CVE-2026-9830 BookingPress Pro < 5.7.3 - Unauthenticated Customer PII Disclosure and Booking Tampering via Permission Callback Bug

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other...

EUVD-2026-49085

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other...

CVE-2026-9830

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other...

CVE-2026-9830

CVE-2026-9830 affects BookingPress Appointment Booking Pro for WordPress prior to 5.7.3. The root cause is a REST permission callback not being invoked, leaving all routes in a REST API namespace accessible without authentication. This allows unauthenticated attackers to read customer booking dat...

CVE-2026-14289

The vulnerability affects the FacturaONE para WooCommerce con VeriFactu WordPress plugin prior to version 5.37. The issue is an unauthenticated access flaw in one request handler, where protection relies on an empty cryptographic key in the default/unconfigured state. This enables unauthenticated...

CVE-2026-14289 WP FacturaONE < 5.37 - Unauthenticated Remote Code Execution

The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one of its request handlers, whose only protection is derived from a cryptographic key that is empty in the default, unconfigured state, allowing unauthenticated attackers to write an arbitrary file...

CVE-2026-14289 WP FacturaONE < 5.37 - Unauthenticated Remote Code Execution

The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one of its request handlers, whose only protection is derived from a cryptographic key that is empty in the default, unconfigured state, allowing unauthenticated attackers to write an arbitrary file...

CVE-2026-14568 WP User Frontend < 4.3.8 - Unauthenticated Author-less Attachment Deletion

The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 does not correctly verify ownership before deleting an attachment, allowing unauthenticated attackers to permanently delete author-less attachments su...

CVE-2026-14568

CVE-2026-14568 affects the WordPress plugin “User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration” (before 4.3.8). The vulnerability arises because the plugin does not correctly verify ownership before deleting an attachment, enabling un...

CVE-2026-14289

The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one of its request handlers, whose only protection is derived from a cryptographic key that is empty in the default, unconfigured state, allowing unauthenticated attackers to write an arbitrary file...

CVE-2026-14568

The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 does not correctly verify ownership before deleting an attachment, allowing unauthenticated attackers to permanently delete author-less attachments su...

EUVD-2026-49082

The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 does not correctly verify ownership before deleting an attachment, allowing unauthenticated attackers to permanently delete author-less attachments su...

EUVD-2026-49075

The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request...

EUVD-2026-49077

The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before reflecting it into the HTML response, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of...

EUVD-2026-49073

The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the...

CVE-2026-13597

CVE-2026-13597 affects the WordPress plugin for 微信二维码登陆 (QR code login) versions

CVE-2026-13597 QRcode Login for WeChat <= 1.3 - Unauthenticated Account Takeover

The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the...

CVE-2026-13152

The CVE concerns the Custom Fields Account Registration For WooCommerce WordPress plugin, pre-1.4. The issue allows an unauthenticated user who registers an account to gain administrator privileges by writing to the user capabilities meta key on sites using a non-default database table prefix, if...

CVE-2026-13390 The Events Calendar < 6.16.5.1 - Unauthenticated Event Aggregator Import Status Manipulation

The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing import records as failed and to store...