CVE-2026-81283 WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...

CVE-2026-81283

WP User Frontend is a WordPress plugin affected by a PHP Object Injection vulnerability in versions 4.3.10 and below . The vulnerability requires low privileges (subscriber-level access), no user interaction, and a low attack complexity, making it accessible to any authenticated subscriber on a s...

WordPress WP Statistics plugin <= 14.16.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by TwinSecKR in WordPress Plugin WP Statistics versions = 14.16.11...

WordPress WP Go Maps plugin <= 10.1.08 - Denial of Service Attack vulnerability

Denial of Service Attack vulnerability discovered by Asim Alshaya in WordPress Plugin WP Go Maps versions = 10.1.08...

WordPress Mang Board WP plugin <= 2.3.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by John Ryan Albon in WordPress Plugin Mang Board WP versions = 2.3.8...

CVE-2026-19116

The User Frontend WordPress plugin before version 4.3.11 is vulnerable to PHP Object Injection because it fails to prevent the deserialization of user-supplied field values. This occurs when a submitted post is reopened within its frontend editing form. Attackers with subscriber-level access or h...

CVE-2026-14982

The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server,...

CVE-2026-14982 WP File Download <= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter

The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server,...

EUVD-2026-69821

The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server,...

CVE-2026-14982 WP File Download <= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter

The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server,...

CVE-2026-14982

The WP File Download plugin for WordPress (versions ≤ 6.3.4 ) is vulnerable to arbitrary file deletion via insufficient path validation in the delete function. Authenticated attackers with subscriber-level access or above can exploit a two-stage attack : first calling the file.save endpoint to pe...

PT-2026-84592

The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server,...

CVE-2025-8945: Incorrect Authorization

The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API...

PT-2026-84704

Unauthenticated Denial of Service Attack in WP Go Maps = 10.1.08 versions...

CVE-2026-82223: Missing Authorization

Unauthenticated Broken Access Control in WP Event SOlution = 4.1.22 versions...

PT-2026-84751

The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...

CVE-2026-14982: Improper Limitation of a Pathname to a Restricted Directory

The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server,...

CVE-2026-84780: Allocation of Resources Without Limits or Throttling

Unauthenticated Denial of Service Attack in WP Go Maps = 10.1.08 versions...

CVE-2026-84770: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Mang Board WP = 2.3.8 versions...

CVE-2026-83533: Insufficient Verification of Data Authenticity

The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...