EUVD-2026-65202

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing...

CVE-2026-56704

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing...

EUVD-2026-65159

Unauthenticated Arbitrary File Deletion in MasterStudy LMS = 3.7.42 versions...

EUVD-2026-65176

Unauthenticated Cross Site Scripting XSS in Stripe Payments = 2.1.2 versions...

EUVD-2026-65168

Unauthenticated Broken Authentication in WPLegalPages = 3.7.0 versions...

EUVD-2026-65162

Unauthenticated SQL Injection in Boost = 2.0.4 versions...

EUVD-2026-65171

Unauthenticated Cross Site Scripting XSS in Toolset Blocks = 1.6.26 versions...

EUVD-2026-65170

Unauthenticated Cross Site Scripting XSS in Event Tickets = 5.29.2.1 versions...

EUVD-2026-65172

Unauthenticated PHP Object Injection in The Events Calendar = 6.17.2 versions...

EUVD-2026-65173

Subscriber Broken Access Control in AutomatorWP = 5.8.3 versions...

EUVD-2026-65163

Unauthenticated Cross Site Scripting XSS in Boost = 2.0.4 versions...

EUVD-2026-65174

Unauthenticated Privilege Escalation in TranslatePress = 3.3.2 versions...

EUVD-2026-65164

Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...

EUVD-2026-65161

Unauthenticated SQL Injection in WooBeWoo Product Filter Pro = 3.1.8 versions...

CVE-2026-78267

CVE-2026-78267 is an unauthenticated privilege escalation vulnerability in the TranslatePress WordPress plugin, affecting versions 3.3.2 and earlier . With a CVSS 3.1 score of 9.8 (Critical) , the flaw is exploitable over the network with low complexity, requiring no prior authentication or user ...

CVE-2026-78263

Event Tickets WordPress plugin versions

CVE-2026-78259

CVE-2026-78259 is an unauthenticated Broken Authentication vulnerability in the WPLegalPages WordPress plugin, affecting versions ≤ 3.7.0 . A remote, unauthenticated attacker can exploit this over the network with low complexity and no user interaction, resulting in low-impact compromises to conf...

CVE-2026-32561

CVE-2026-32561 is a Subscriber Privilege Escalation vulnerability in the WordPress Booking Hub plugin, affecting versions 1.3.0 and earlier . The flaw allows a low-privileged Subscriber user to escalate privileges, rated CVSS 8.8 (High) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indica...

CVE-2026-32559

UltimateAI is a WordPress plugin affected by an arbitrary file upload vulnerability in versions ≤ 3.1.0 . A user with Subscriber privilege level can upload arbitrary files without user interaction, with a scope change that allows full compromise of confidentiality, integrity, and availability (CV...

CVE-2026-27364

Broken Access Control vulnerability in the WordPress Style Kits plugin (AnalogWP) versions ≤ 2.6.5 . A Subscriber -level authenticated user can exploit insufficient access controls, resulting in a high impact on integrity (CVSS 3.1: 6.5 MEDIUM, vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). No conf...