WordPress JetPopup plugin <= 2.0.20.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Bonds in WordPress Plugin JetPopup versions = 2.0.20.2...

CVE-2026-82923

The AI Website Builder WordPress plugin GitHub build 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into th...

EUVD-2026-70993

The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking...

CVE-2026-84045

The E-cab Taxi Booking Manager for Woocommerce WordPress plugin, in versions before 2.0.5 , fails to validate client-supplied trip distance and base-price values on the server before pricing a booking. This allows unauthenticated attackers to manipulate the order total down to zero and place real...

WordPress E-cab Taxi Booking Manager for Woocommerce plugin < 2.0.5 - Unauthenticated Price Manipulation vulnerability

Unauthenticated Price Manipulation vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Taxi Booking Manager for WooCommerce versions 2.0.5...

CVE-2026-84044 Restaurant Menu and Food Ordering < 2.4.12 - Unauthenticated Payment Bypass via Forged PayPal IPN

The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment...

CVE-2026-84044

The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 fails to verify that a PayPal Instant Payment Notification (IPN) genuinely originates from PayPal. This allows unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without maki...

EUVD-2026-70992

The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment...

CVE-2026-84043 ePayco Payment Gateway for WooCommerce < 8.4.7 - Unauthenticated Payment Confirmation Bypass

The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of payment confirmation requests, allowing unauthenticated attackers to mark orders as paid without a valid gateway signature...

CVE-2026-82923 AI Website Builder (GitHub build) 1.0.0 - Unauthenticated RCE via Unprotected REST Routes

The AI Website Builder WordPress plugin GitHub build 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into th...

CVE-2026-82923

The AI Website Builder WordPress plugin (GitHub build 1.0.0 ) lacks any authorization or nonce check on its REST API routes. This allows an unauthenticated attacker to install and activate plugins and themes, import content from an attacker-controlled URL, write an arbitrary file into the uploads...

EUVD-2026-70990

The AI Website Builder WordPress plugin GitHub build 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into th...

CVE-2026-27432

Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Rentals: from n/a before 3.16.0...

CVE-2026-32480

Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership: from n/a through 2.11.11...

CVE-2026-57777 WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Automattic WooCommerce allows Blind SQL Injection. This issue affects WooCommerce: from n/a before 11.0...

WordPress WooCommerce plugin <= 10.9.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WooCommerce versions = 10.9.4...

CVE-2026-85311 WordPress MarketKing plugin <= 2.1.60 - Broken Access Control vulnerability

Missing Authorization vulnerability in Kings Plugins MarketKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MarketKing: from n/a through 2.1.60...

WordPress MarketKing plugin <= 2.1.60 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by sungbyeongchan in WordPress Plugin MarketKing versions = 2.1.60...

CVE-2026-32480 WordPress WCFM Membership plugin <= 2.11.11 - Broken Access Control vulnerability

Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership: from n/a through 2.11.11...

CVE-2026-32480

CVE-2026-32480 affects the WCFM Membership WordPress plugin (by WC Lovers) in versions up to and including 2.11.11 . The vulnerability is a missing authorization (broken access control) flaw that allows exploitation of incorrectly configured access control security levels. The CVSS v3.1 score is ...