CVE-2026-109145

The User Rights Access Manager WordPress plugin (versions

EUVD-2026-101854

The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them...

CVE-2026-109145 User Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Registration Handler

The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an...

CVE-2026-104643 Easy HTTPS Redirection (SSL) < 2.0.2 - Subscriber+ Scan Result Disclosure and Site-Wide URL Rewrite

The Easy HTTPS Redirection SSL WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private and draft posts and from site options, and to trigger a...

CVE-2026-106031

The Spin Wheel WordPress plugin, in versions prior to 2.2.1 , is vulnerable to Unauthenticated Coupon Code Disclosure due to a lack of verification that a visitor performed a legitimate spin. Attackers can forge spin results to disclose and drain stored prize coupon codes from any campaign, inclu...

CVE-2026-106031 Spin Wheel < 2.2.1 - Unauthenticated Coupon Code Disclosure via Forged Spin Result

The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones...

CVE-2026-104643

The Easy HTTPS Redirection (SSL) WordPress plugin, in versions before 2.0.2 , contains a vulnerability where it fails to perform capability checks on certain AJAX actions . This flaw allows any authenticated user , such as a Subscriber, to access URLs collected by the plugin's content scanner fro...

EUVD-2026-101851

The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones...

CVE-2026-103304 eaSYNC < 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template Update

The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the email...

WordPress Spin Wheel plugin < 2.2.1 - Unauthenticated Coupon Code Disclosure vulnerability

Unauthenticated Coupon Code Disclosure vulnerability discovered by Aditya Gurav in WordPress Plugin Spin Wheel versions 2.2.1...

WordPress Easy HTTPS Redirection (SSL) plugin < 2.0.2 - Subscriber+ Scan Result Disclosure and Site-Wide URL Rewrite vulnerability

Subscriber+ Scan Result Disclosure and Site-Wide URL Rewrite vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Easy HTTPS Redirection SSL versions 2.0.2...

CVE-2026-103304

The eaSYNC Booking WordPress plugin, in versions before 1.3.31 , is vulnerable to an authorization and nonce check deficiency. The flaw resides in several cancellation-related AJAX actions , which allows unauthenticated users to create booking cancellation requests, trigger booking notification e...

EUVD-2026-101849

The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the email...

CVE-2026-106031 Spin Wheel < 2.2.1 - Unauthenticated Coupon Code Disclosure via Forged Spin Result

The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones...

CVE-2026-103304 eaSYNC < 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template Update

The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the email...

CVE-2026-104643 Easy HTTPS Redirection (SSL) < 2.0.2 - Subscriber+ Scan Result Disclosure and Site-Wide URL Rewrite

The Easy HTTPS Redirection SSL WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private and draft posts and from site options, and to trigger a...

EUVD-2026-101850

The Easy HTTPS Redirection SSL WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private and draft posts and from site options, and to trigger a...

CVE-2026-15180

The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 2.6.0 . The root cause is insufficient input sanitization and output escaping of the 'TCM_ErrorMessages' POST parameter. This allows unauthenticated attackers t...

CVE-2026-78087 VK Blocks <= 1.126.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Group Block 'linkToPost' Feature

The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.126.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

EUVD-2026-101846

The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCMErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...