CVE-2026-84821: Missing Authorization

Unauthenticated Broken Access Control in WP Fast Total Search = 1.82.284 versions...

PT-2026-89266

The WP BackItUp Community Edition plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.0 via the 'backup file' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of...

PT-2026-89450

Unauthenticated Broken Access Control in WP Fast Total Search = 1.82.284 versions...

CVE-2026-15823: Missing Authorization

The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable function in versions up to, and including, 3.0.2. The wpajaxbacheetahdisable AJAX handler is registered without any capability or nonce...

CVE-2026-81796: Authentication Bypass Using an Alternate Path or Channel

Authentication Bypass Using an Alternate Path or Channel vulnerability in WEN Solutions WP Travel wp-travel allows Password Recovery Exploitation.This issue affects WP Travel: from n/a through 12.0.3...

CVE-2026-18386: Improper Limitation of a Pathname to a Restricted Directory

The WP BackItUp Community Edition plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.0 via the 'backupfile' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of...

PT-2026-89441

Unauthenticated Broken Authentication in WP Travel = 12.0.3 versions...

Exploit for SQL Injection in Wpfastestcache Wp_Fastest_Cache

CVE-2023-6063 — WP Fastest Cache SQL Injection PoC !Python...

WordPress WP BackItUp Community Edition plugin <= 2.1.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read vulnerability

Authenticated Administrator+ Path Traversal to Arbitrary File Read vulnerability discovered by Nikola Kojic in WordPress Plugin WP BackItUp versions = 2.1.0...

WordPress WP Grid Builder plugin <= 2.3.3 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by h0xilo in WordPress Plugin WP Grid Builder versions = 2.3.3...

WordPress WP Fast Total Search plugin <= 1.82.284 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by William Honnér in WordPress Plugin WP Fast Total Search versions = 1.82.284...

WordPress WP Docs plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dodoh4t in WordPress Plugin WP Docs versions = 2.3.4...

CVE-2026-80099

Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the authenticate method — registered on the restauthenticationerrors filter and therefore evaluated for every unauthenticated REST API...

EUVD-2026-74773

Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the authenticate method — registered on the restauthenticationerrors filter and therefore evaluated for every unauthenticated REST API...

CVE-2026-80099 Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret

Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the authenticate method — registered on the restauthenticationerrors filter and therefore evaluated for every unauthenticated REST API...

CVE-2026-80099 Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret

Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the authenticate method — registered on the restauthenticationerrors filter and therefore evaluated for every unauthenticated REST API...

CVE-2026-80099 Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret

Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the authenticate method — registered on the restauthenticationerrors filter and therefore evaluated for every unauthenticated REST API...

CVE-2026-80099

CVE-2026-80099 affects several Newfold WordPress plugins (Crazy Domains, Web, Hostgator, Bluehost) that bundle the wp-module-data module. The root cause is an HMAC-style Bearer token validation flaw : when HiiveConnection::get_auth_token() returns false, PHP coerces strrev(false) to an empty stri...

WordPress WP Crowdfunding plugin <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Crowdfunding versions = 2.2.1...

WordPress Shopping Cart & eCommerce Store plugin <= 5.9.3 - Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action vulnerability

Authenticated Store Manager+ Privilege Escalation to ecajaxsavepagedefaultoptions AJAX Action vulnerability discovered by Wordfence PRISM in WordPress Plugin WP EasyCart versions = 5.9.3...