CVE-2026-61954

CVE-2026-61954 affects the WordPress PayU India plugin up to version 3.8.9, with an Unauthenticated Broken Access Control vulnerability. The available documents identify the affected product (WordPress PayU India plugin) and the vulnerable version range (

EUVD-2026-48209

Unauthenticated Privilege Escalation in TrueBooker = 1.2.3 versions...

CVE-2026-61950

CVE-2026-61950 : Unauthenticated SQL injection in the WordPress plugin TrueBooker (versions <= 1.2.3). The CVE entry indicates a high-severity, network-exposed vulnerability with low attack complexity and no privileges required. The impact is highlighted as high confidentiality impact and low ...

EUVD-2026-48207

Unauthenticated SQL Injection in Bookly = 27.7 versions...

EUVD-2026-48206

Unauthenticated SQL Injection in WPDM – Premium Packages = 6.2.0 versions...

EUVD-2026-48200

Unauthenticated Broken Authentication in Ziina = 1.2.21 versions...

CVE-2026-59542

The vulnerability CVE-2026-59542 affects the WordPress Kali Forms plugin

EUVD-2026-48181

Unauthenticated Cross Site Request Forgery CSRF in Ninja Forms File Uploads Extension = 3.3.26 versions...

EUVD-2026-48168

Unauthenticated Broken Access Control in Autopay dla WooCommerce = 2.2.27 versions...

EUVD-2026-48164

Customer Cross Site Scripting XSS in Funnel Kit Funnel Builder PRO = 3.15.0.4 versions...

EUVD-2026-48159

Unauthenticated Broken Access Control in WP Fast Total Search = 1.81.282 versions...

CVE-2026-27403

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NerdPress Hubbub Lite allows Stored XSS. This issue affects Hubbub Lite: from n/a through 1.36.3...

EUVD-2026-48157

Unauthenticated Broken Access Control in MarketKing = 2.1.40 versions...

CVE-2026-24639

The CVE-2026-24639 entry concerns the WordPress Photo Block plugin (

EUVD-2026-48146

Author Server Side Request Forgery SSRF in Photo Block = 1.7.1 versions...

CVE-2026-25405 WordPress eRoom plugin <= 1.7.1 - SQL Injection vulnerability

Contributor SQL Injection in eRoom = 1.7.1 versions...

CVE-2026-25405

CVE-2026-25405 affects the WordPress eRoom plugin (≤ 1.7.1). It is a reported SQL Injection vulnerability. CVSSv3.1: 8.5 (HIGH), NETWORK, LOW privileges, no user interaction, confidentiality impact HIGH, integrity and availability variances (I: NONE, A: LOW), scope changed. Connected documents pr...

EUVD-2025-210505

Administrator Cross Site Scripting XSS in WP-Polls = 2.77.3 versions...

WordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Qubely versions = 1.8.14...

CVE-2026-15794 Grid/List View for WooCommerce <= 3.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'position' Shortcode Attribute

The Grid/List View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'position' Shortcode Attribute in all versions up to, and including, 3.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...