CVE-2026-19251 Ultimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile Activity

The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation...

CVE-2026-14215

CVE-2026-14215 affects the Booking for Appointments and Events Calendar WordPress plugin (also referred to as Amelia ) in versions prior to 2.4.9 . The root cause is a missing authentication or valid request token check before executing the post-booking action chain . An unauthenticated attacker ...

CVE-2026-12526 Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...

CVE-2026-16966

Solace Extra WordPress plugin before 1.7.0 has a missing authorization and post-status check in its get_elementor_content AJAX action. This allows unauthenticated visitors to read the content of non-published Site Builder parts (draft, pending, private, and trashed) that WordPress would normally ...

WordPress Booking for Appointments and Events Calendar plugin < 2.4.9 - Unauthenticated Post-Booking Action Trigger vulnerability

Unauthenticated Post-Booking Action Trigger vulnerability discovered by Haitam Lazaar in WordPress Plugin Amelia versions 2.4.9...

EUVD-2026-69868

The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an...

EUVD-2026-69869

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by...

CVE-2026-12526

Advanced Custom Fields: Extended WordPress plugin versions before 0.9.2.7 contain an authorization bypass in the update-user action of its front-end Forms module. The plugin only enforces a capability check when the submitted role is administrator or super_admin , failing to verify that the reque...

CVE-2026-15232

The MotoPress Appointment Booking WordPress plugin before 2.4.8 lacks an authorization or ownership check when processing a user-supplied booking identifier on an unauthenticated endpoint , allowing attackers to permanently delete other users' reservations. This is an incomplete fix of CVE-2026-9...

CVE-2026-16966 Solace Extra < 1.7.0 - Unauthenticated Draft/Private Site Builder Content Disclosure via get_elementor_content

The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published draft, pending, private, and trashed Site Builder parts that WordPress would otherwise not ser...

WordPress MotoPress Appointment Booking plugin < 2.4.8 - Unauthenticated Arbitrary Reservation Deletion vulnerability

Unauthenticated Arbitrary Reservation Deletion vulnerability discovered by Ahmed Hashim Ismael in WordPress Plugin MotoPress Appointment Booking versions 2.4.8...

CVE-2026-12865 Photo Gallery by 10Web < 1.8.44 - Reflected XSS via title and paged Parameters

The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages one on the Shortcode page, one on the Galleries/Albums list page, so an unauthenticated attacker can craft a link that, when opene...

EUVD-2026-69871

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...

CVE-2026-15232 Appointment Booking Lite < 2.4.8 - Unauthenticated Arbitrary Reservation Deletion

The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an...

CVE-2026-14215 Amelia < 2.4.9 - Unauthenticated Post-Booking Action Trigger

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by...

EUVD-2026-69867

The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published draft, pending, private, and trashed Site Builder parts that WordPress would otherwise not ser...

WordPress Solace Extra plugin < 1.7.0 - Unauthenticated Draft/Private Site Builder Content Disclosure vulnerability

Unauthenticated Draft/Private Site Builder Content Disclosure vulnerability discovered by JunHee CHO in WordPress Plugin Solace Extra versions 1.7.0...

WordPress TranslatePress – Translate Multilingual sites with AI Translation plugin <= 3.3.1 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Yuto Hyakumoto in WordPress Plugin TranslatePress versions = 3.3.1...

telnetd_CVE-2026-24061_tester

Script de Prueba Telnetd CVE-2026-24061 Una herramienta de pruebas de seguridad en Python para detectar vulnerabilidades de inyección de variables de entorno en servidores telnetd mediante la opción telnet NEW-ENVIRON. Descripción General Este script prueba servidores telnetd para detectar...

EUVD-2026-69872

The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletesubmissionfiles function in all versions up to, and including, 1.4.11. This makes it possible for unauthenticated attackers to delete arbitra...