CVE-2026-82023 LearnPress WordPress Plugin < 4.4.6 Broken Object-Level Authorization via Quiz Answer Insert

LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path...

CVE-2026-84762

Unauthenticated Bypass Vulnerability in WP EasyPay = 4.5.3 versions...

CVE-2026-81300

Unauthenticated Cross Site Scripting XSS in Calculation For Contact Form 7 = 1.0 versions...

CVE-2026-81776

Unauthenticated Cross Site Scripting XSS in WP QuickLaTeX = 3.8.8 versions...

CVE-2026-85304 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.17 - Broken Access Control vulnerability

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unlimited Elements For Elementor Free Widgets, Addons, Templates: from n/a through...

CVE-2026-85309

CVE-2026-85309 is a Missing Authorization (Broken Access Control) vulnerability in the Ultimate Maps by Supsystic WordPress plugin, affecting versions from unspecified through 1.5.3 . Unauthenticated attackers can exploit incorrectly configured access control security levels over the network with...

CVE-2026-85309 WordPress Ultimate Maps by Supsystic plugin <= 1.5.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Maps by Supsystic: from n/a through 1.5.3...

CVE-2026-85308

Brainstorm Force SureForms , a WordPress plugin, is affected by an Authorization Bypass Through User-Controlled Key (IDOR) vulnerability in versions from n/a through 2.12.5 . The flaw allows exploitation of incorrectly configured access control security levels, meaning an unauthenticated remote a...

CVE-2026-85307 WordPress KP Agent Ready plugin < 1.2.08 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Kevin Pirnie KP Agent Ready allows Retrieve Embedded Sensitive Data. This issue affects KP Agent Ready: from n/a before 1.2.08...

CVE-2026-85307

KP Agent Ready is a WordPress plugin developed by Kevin Pirnie. Versions prior to 1.2.08 are affected by an Insertion of Sensitive Information Into Sent Data vulnerability that allows an unauthenticated remote attacker to retrieve embedded sensitive data. The CVSS v3.1 score is 5.3 (Medium) with ...

CVE-2026-85306 WordPress MountDev AI MCP Connector for WordPress plugin <= 1.6.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in Cascadia Web Services MountDev AI MCP Connector for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MountDev AI MCP Connector for WordPress: from n/a through 1.6.5...

CVE-2026-85306

MountDev AI MCP Connector for WordPress , a plugin by Cascadia Web Services, is affected by a Missing Authorization (Broken Access Control) vulnerability in versions from unspecified up to 1.6.5 . The flaw allows exploitation of incorrectly configured access control security levels, granting a lo...

CVE-2026-85305 WordPress SEOPress plugin <= 10.1 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in SEOPress allows Server Side Request Forgery. This issue affects SEOPress: from n/a through 10.1...

CVE-2026-85305

A Server-Side Request Forgery (SSRF) vulnerability affects the SEOPress WordPress plugin in versions from n/a through 10.1 . The flaw allows an attacker to force the server to make unintended requests. The CVSS v3.1 score is 5.4 (MEDIUM) , with a network vector, low complexity, low privileges req...

CVE-2026-85303

CVE-2026-85303 affects the Booking and Rental Manager WordPress plugin by Magepeople inc. , with a Stored XSS vulnerability present in versions from unspecified through 2.7.7 . The flaw stems from improper neutralization of input during web page generation, allowing an attacker with low privilege...

CVE-2026-85303 WordPress Booking and Rental Manager plugin <= 2.7.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Magepeople inc. Booking and Rental Manager allows Stored XSS. This issue affects Booking and Rental Manager: from n/a through 2.7.7...

WordPress Ultimate Maps by Supsystic plugin <= 1.5.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Ultimate Maps by Supsystic versions = 1.5.3...

WordPress KP Agent Ready plugin <= 1.1.99 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin KP Agent Ready versions = 1.1.99...

WordPress MountDev AI MCP Connector for WordPress plugin <= 1.6.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MountDev AI MCP Connector for WordPress versions = 1.6.5...

WordPress SEOPress plugin <= 10.1 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by MYUNGYONG LEE in WordPress Plugin SEOPress versions = 10.1...