CVE-2026-76586

The Appointment Booking Calendar Plugin and Scheduling Plugin (also known as BookingPress ) for WordPress, versions 1.5.6 through 1.6.2 , contains a payment validation flaw. When confirming an online PayPal payment, the plugin does not verify the amount actually paid against the server-side price...

CVE-2026-77007

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin (through 1.0.3 ) contains a missing authorization check on one of its REST API routes . This allows unauthenticated users to retrieve the plugin's stored settings, including the shared secret used to sign API requests to the ...

EUVD-2026-68052

The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media item...

CVE-2026-76548

CVE-2026-76548 affects the User Profile Builder WordPress plugin in versions before 4.0.1 . The front-end file upload feature fails to properly restrict access, granting unauthenticated visitors capabilities normally reserved for privileged roles. This allows attackers to list the site's media li...

CVE-2026-19430

CVE-2026-19430 affects the Catfolders Document Gallery Pro WordPress plugin (versions before 2.0.7). The root cause is missing authorization on certain REST API routes combined with a client-side forgeable token that identifies the requested content. This allows unauthenticated users to list and ...

EUVD-2026-68049

The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and the token identifying the requested content is forgeable client side, allowing unauthenticated users to list and download the contents of folders that were never published on the...

CVE-2026-76548 Profile Builder < 4.0.1 - Unauthenticated Unpublished Content and Media Modification via Front-End Upload Auth Bypass

The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media item...

CVE-2026-17520 Newsletters < 4.17 - Unauthenticated API Access via Predictable API Key

The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value, allowing unauthenticated attackers to compute the key and perform privileged actions such as adding and deleting subscribers and sending emails,...

CVE-2026-16947 Total Processing Card Payments for WooCommerce <= 7.3 - Unauthenticated SSRF leading to Payment Bypass and Gateway Credential Disclosure

The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response, allowing unauthenticated attackers to redirect that request to ...

CVE-2026-17520

The Newsletters WordPress plugin before 4.17 fails to generate its API key from a sufficiently random source, instead deriving it from a publicly known value . When the plugin's optional API is enabled, this allows unauthenticated attackers to compute the key and perform privileged actions such a...

CVE-2026-16947

CVE-2026-16947 affects the Total processing card payments for WooCommerce WordPress plugin (through version 7.3 ). The plugin fails to validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response. This allows unaut...

EUVD-2026-68045

The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value, allowing unauthenticated attackers to compute the key and perform privileged actions such as adding and deleting subscribers and sending emails,...

EUVD-2026-68044

The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response, allowing unauthenticated attackers to redirect that request to ...

CVE-2026-16061 Rest Routes <= 5.5.5 - Unauthenticated SQLi via custom-tables/tables/{table_name}

The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from the URL of one of its public REST routes before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks...

EUVD-2026-68041

The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from the URL of one of its public REST routes before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks...

EUVD-2026-68042

The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcoded and identical across every install, allowing...

CVE-2026-16259

CVE-2026-16259 affects the Uix UserCenter WordPress plugin through version 1.0.3 . The plugin's unauthenticated profile-update action fails to verify that the modified account belongs to the requester and authenticates the action with a token whose signing key is hardcoded and identical across ev...

CVE-2026-16061

CVE-2026-16061 affects the Rest Routes WordPress plugin (versions through 5.5.5 ). The vulnerability exists in the public REST route custom-tables/tables/{table_name}, where a value taken from the URL is used in a SQL query without proper sanitization or validation. This allows unauthenticated at...

EUVD-2026-68040

The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process, allowing unauthenticated attackers to register a new user with an arbitrary role, including Administrator, leading to a full site takeover. Version 6.9 is...

CVE-2026-16259 Uix UserCenter <= 1.0.3 - Unauthenticated Privilege Escalation

The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcoded and identical across every install, allowing...