CVE-2026-66671

Unauthenticated Local File Inclusion in Verdure Core = 1.2 versions...

CVE-2026-66584

Unauthenticated Cross Site Scripting XSS in 12 Step Meeting List = 3.19.16 versions...

CVE-2026-66599

Unauthenticated Cross Site Scripting XSS in WPComplete = 2.9.5.6 versions...

CVE-2026-28190

Subscriber Broken Access Control in ProLancer Element = 1.4.8 versions...

CVE-2026-32478

Subscriber SQL Injection in WP Project Manager Pro = 4.0.1 versions...

CVE-2026-32551

Unauthenticated SQL Injection in Woo Essential = 4.3.0 versions...

CVE-2026-28165

Unauthenticated Privilege Escalation in Digits = 9.2 versions...

CVE-2026-28166

Unauthenticated Cross Site Scripting XSS in Tourmaster = 5.4.9 versions...

CVE-2026-28162

Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...

CVE-2026-28151

Unauthenticated Local File Inclusion in Tonda 2.6 versions...

CVE-2026-66650

CVE-2026-66650 is an unauthenticated PHP Object Injection vulnerability in the WordPress theme FreightCo , affecting versions ≤ 1.1.15 . Discovered by daroo , it allows a remote, unauthenticated attacker to achieve full compromise (confidentiality, integrity, and availability), rated CVSS 9.8 (CR...

EUVD-2026-64808

Unauthenticated Privilege Escalation in Jawn = 1.4.2 versions...

EUVD-2026-64803

Unauthenticated SQL Injection in Woo Essential = 4.3.0 versions...

EUVD-2026-64801

Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons = 2.2.0 versions...

CVE-2026-32478 WordPress WP Project Manager Pro plugin <= 4.0.1 - SQL Injection vulnerability

Subscriber SQL Injection in WP Project Manager Pro = 4.0.1 versions...

CVE-2026-32478

CVE-2026-32478 is a Subscriber-level SQL Injection vulnerability in the WP Project Manager Pro WordPress plugin (versions ≤ 4.0.1 ), discovered by researcher dutafi . The flaw allows a user with the low-privilege Subscriber role to execute arbitrary SQL queries, resulting in high confidentiality ...

CVE-2026-32476

An unauthenticated Cross-Site Scripting (XSS) vulnerability affects the Brave Conversion Engine (PRO) WordPress plugin (slug: bravepopup-pro ) in versions ≤ 0.8.6 . The flaw requires user interaction (CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1 HIGH with a Changed scope, indic...

EUVD-2026-64800

Unauthenticated Cross Site Scripting XSS in Brave Conversion Engine PRO = 0.8.6 versions...

EUVD-2026-64799

Subscriber SQL Injection in ProLancer Element = 1.4.8 versions...

CVE-2026-28190

CVE-2026-28190 is a Broken Access Control vulnerability in the ProLancer Element WordPress plugin, affecting versions 1.4.8 and earlier . The flaw allows users with the Subscriber role to perform actions beyond their intended privilege level, resulting in primarily integrity impact and minor avai...