EUVD-2026-119477

The Sync Post With Other Site WordPress plugin before 1.9.4 does not properly authorize a content-management action for post types other than pages, allowing users with Contributor-level access or above to create and modify arbitrary custom post types, including reassigning content authorship...

EUVD-2026-119478

The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that protects it, allowing unauthenticated attackers to create an administrator account or write arbitrary site options, leading t...

CVE-2026-110963

The Userplace WordPress plugin (version 1.2.0 and below ) is vulnerable to an unauthenticated privilege escalation flaw. The software fails to perform proper authorization checks on an AJAX action accessible to unauthenticated users and publicly exposes the associated nonce . This allows an attac...

CVE-2026-110132

The Sync Post With Other Site WordPress plugin (versions prior to 1.9.4 ) contains a vulnerability where it fails to properly authorize content-management actions for post types other than pages. This flaw allows users with Contributor-level access or higher to create and modify arbitrary custom ...

EUVD-2026-119476

The Productive Commerce WordPress plugin before 1.1.54 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...

EUVD-2026-119475

The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate account owner, nor limit verification attempts, allowing unauthenticated attackers to take over any account, including administrators...

CVE-2026-96963

The Pie Register WordPress plugin, affecting versions up to 3.8.4.15 , contains an authorization check deficiency in one of its AJAX actions . This flaw allows users with privileges as low as a contributor to modify invitation-code records originally created by administrators. No specific exploit...

CVE-2026-104338

The Razorpay for WooCommerce WordPress plugin, in versions before 4.8.9 , contains a vulnerability where it fails to perform an authorization check on a specific REST route. The plugin incorrectly derives the acting user's identity from an unauthenticated request parameter . This allows an unauth...

CVE-2026-114432

The Contact Form 7 WordPress plugin versions prior to 6.2.4 is vulnerable to an unauthenticated arbitrary file upload flaw. The issue stems from a failure to validate file types or extensions in form file fields, combined with a flaw in temporary-file cleanup that leaves files on the disk. Depend...

EUVD-2026-119469

The Turisbook Booking System WordPress plugin through 1.3.8 does not have authorisation and CSRF checks when saving its settings, and does not sanitise and escape one of them before outputting it in an admin page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks again...

EUVD-2026-119472

The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not perform an authorization check on one of its REST routes and derives the acting user's identity from an unauthenticated request parameter, allowing an unauthenticated attacker to cause the request to execute as an arbitrary user...

CVE-2026-103303

The Turisbook Booking System WordPress plugin (versions through 1.3.8 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The issue arises because the plugin lacks proper authorisation and CSRF checks when saving settings, and fails to sanitise and escape one of these settings before displayin...

EUVD-2026-119467

The Pie Register WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions, allowing users with a role as low as contributor to modify existing administrator-created invitation-code records...

EUVD-2026-119468

The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension of files uploaded through a form file field, and a flaw in its temporary-file cleanup leaves the uploaded file on disk, allowing unauthenticated users to upload arbitrary files to the site. On a stock Debian ...

CVE-2026-97192

The Secure Custom Fields WordPress plugin versions prior to 6.9.8 contains a vulnerability where it fails to re-apply field-group location rules when persisting values submitted through the post editor save path . This flaw allows users with contributor-level access and above to bypass restrictio...

EUVD-2026-119465

The Antom Payments WordPress plugin through 2.0.11 does not perform any ownership or authorisation check before returning an order's confirmation link, which contains its secret key, to unauthenticated visitors, allowing attackers to view any customer's order details, including name, address, pho...

EUVD-2026-119464

The Secure Custom Fields WordPress plugin before 6.9.8 does not sanitize a persisted field definition before emitting part of it as an HTML attribute name, allowing a user able to configure its fields to store a payload that executes as JavaScript in the browser of any user who views a page...

EUVD-2026-119462

The Secure Custom Fields WordPress plugin before 6.9.8 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or remove a reference to their own object o...

EUVD-2026-119466

The Pie Register WordPress plugin through 3.8.4.15 does not perform any capability, nonce or authentication check on one of its request handlers, allowing unauthenticated attackers to reset the Pie Register WordPress plugin through 3.8.4.15's settings to their defaults disabling registration...

CVE-2026-96961

The Pie Register WordPress plugin, in versions through 3.8.4.15 , contains a vulnerability where one of its request handlers fails to perform required capability, nonce, or authentication checks . This security flaw allows unauthenticated attackers to reset the plugin's settings to their defaults...