CVE-2026-57425

CVE-2026-57425 affects the WordPress plugin Autopay dla WooCommerce (versions

EUVD-2026-48168

Unauthenticated Broken Access Control in Autopay dla WooCommerce = 2.2.27 versions...

CVE-2026-57370

Summary (CVE-2026-57370): Unauthenticated reflected Cross Site Scripting (XSS) in WordPress plugin Visitor Traffic Real Time Statistics Pro versions

CVE-2026-27422

The CVE-2026-27422 entry concerns the WordPress YT Player plugin (versions

EUVD-2026-48159

Unauthenticated Broken Access Control in WP Fast Total Search = 1.81.282 versions...

CVE-2026-27399

CVE-2026-27399 concerns the WordPress MarketKing plugin, versions ≤ 2.1.40. The connected documents describe an Unauthenticated Broken Access Control vulnerability in MarketKing, meaning an unauthenticated attacker can bypass access controls. The exact impact details (which data or actions are ex...

EUVD-2026-48157

Unauthenticated Broken Access Control in MarketKing = 2.1.40 versions...

EUVD-2026-48152

Unauthenticated Broken Access Control in Ditty = 3.1.66 versions...

CVE-2026-27372

The CVE concerns WordPress plugin PeproDev Ultimate Invoice (admin URL not needed) for affected versions

CVE-2026-27355

CVE-2026-27355 affects WordPress Ditty plugin versions

EUVD-2026-48150

Unauthenticated Broken Access Control in WP Go Maps = 10.1.04 versions...

CVE-2026-24537

CVE-2026-24537 — Unauthenticated Cross Site Request Forgery (CSRF) in the WordPress plugin WP Accessibility Helper (WAH) , versions

Exploit for Eval Injection in Langflow

CVE-2026-33017 — Langflow Unauthenticated Remote Code Executio...

CVE-2026-65758

Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions...

Exploit for CVE-2026-56121

CVE-2026-56121 — Feast Registry Unauthenticated RCE dill.load...

EUVD-2026-47907

The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers...

CVE-2026-15015

The MountDev AI MCP Connector for WordPress plugin (WordPress) is vulnerable up to version 1.6.1 to an authorization bypass. Unauthenticated attackers can obtain an administrator-bound OAuth Bearer token via a self-registered OAuth client, enabling full administrator-equivalent access to the MCP ...

CVE-2026-15017

The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions up to 1.7.8.4. The root cause is missing capability checks and nonce verification in MDJM_Permissions::set_permissions() and MDJM_Employee_Manager::init(), combined with the absence of server-side...

CVE-2026-15017 MDJM Event Management <= 1.7.8.4 - Authenticated (Subscriber+) Privilege Escalation via 'set-permissions' and 'change_role' Handlers

The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8.4. This is due to missing capability checks and nonce verification in the MDJMPermissions::setpermissions and MDJMEmployeeManager::init functions, combined with the...

EUVD-2026-47901

The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8.4. This is due to missing capability checks and nonce verification in the MDJMPermissions::setpermissions and MDJMEmployeeManager::init functions, combined with the...