EUVD-2026-64806

Unauthenticated Local File Inclusion in WP Cafe Pro 3.0.15 versions...

EUVD-2026-64804

Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress = 8.9.1 versions...

CVE-2026-32558 WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin <= 8.9.1 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress = 8.9.1 versions...

CVE-2026-32558

Affiliate Pro – Affiliate Program for WooCommerce & WordPress , a WordPress plugin, is affected by an unauthenticated privilege escalation vulnerability in versions 8.9.1 and below . An attacker over the network can escalate privileges without prior authentication or user interaction, resulting i...

EUVD-2026-64803

Unauthenticated SQL Injection in Woo Essential = 4.3.0 versions...

CVE-2026-32551

CVE-2026-32551 is an unauthenticated SQL injection in the Woo Essential WordPress plugin, affecting versions ≤ 4.3.0 . Rated CVSS 9.3 (Critical) by Patchstack , the vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) indicates network-accessible exploitation with high confidentiality impact and scope ch...

CVE-2026-32551 WordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerability

Unauthenticated SQL Injection in Woo Essential = 4.3.0 versions...

EUVD-2026-64801

Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons = 2.2.0 versions...

CVE-2026-32477 WordPress ShopBuilder Pro – Elementor WooCommerce Builder Addons plugin <= 2.2.0 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons = 2.2.0 versions...

CVE-2026-32477

CVE-2026-32477 is an unauthenticated arbitrary file deletion vulnerability in the WordPress plugin ShopBuilder Pro – Elementor WooCommerce Builder Addons in versions 2.2.0 and earlier . An attacker can delete arbitrary files over the network without authentication or user interaction, leading to ...

CVE-2026-32476

An unauthenticated Cross-Site Scripting (XSS) vulnerability affects the Brave Conversion Engine (PRO) WordPress plugin (slug: bravepopup-pro ) in versions ≤ 0.8.6 . The flaw requires user interaction (CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1 HIGH with a Changed scope, indic...

EUVD-2026-64800

Unauthenticated Cross Site Scripting XSS in Brave Conversion Engine PRO = 0.8.6 versions...

CVE-2026-32476 WordPress Brave Conversion Engine (PRO) plugin <= 0.8.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Brave Conversion Engine PRO = 0.8.6 versions...

CVE-2026-28171 WordPress WooCommerce File Approval plugin <= 10.7 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in WooCommerce File Approval = 10.7 versions...

EUVD-2026-64797

Unauthenticated Arbitrary File Deletion in WooCommerce File Approval = 10.7 versions...

CVE-2026-28171

CVE-2026-28171 is an unauthenticated arbitrary file deletion vulnerability in the WooCommerce File Approval WordPress plugin, affecting versions 10.7 and earlier . An unauthenticated remote attacker can delete arbitrary files on the server, leading to a high availability impact with changed scope...

EUVD-2026-64796

Unauthenticated Arbitrary File Download in Super Forms = 6.3.315 versions...

CVE-2026-28167

CVE-2026-28167 is an unauthenticated arbitrary file download vulnerability in the WordPress Super Forms plugin affecting versions 6.3.315 and below . The flaw allows a remote attacker to download arbitrary files from the server without authentication, leading to a high confidentiality impact (CVS...

CVE-2026-28167 WordPress Super Forms plugin <= 6.3.315 - Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download in Super Forms = 6.3.315 versions...

CVE-2026-28165

Unauthenticated Privilege Escalation in the WordPress Digits plugin (versions &lt;= 9.2), discovered by VanTastic via Patchstack. The flaw requires no authentication or user interaction, is network-exploitable with low complexity, and carries a CVSS 9.8 (CRITICAL) score with high impact on confid...