WordPress Epeken All Kurir plugin <= 2.1.2 - Unauthenticated Order Payment Confirmation Forgery vulnerability

Unauthenticated Order Payment Confirmation Forgery vulnerability discovered by Pedro Pinho in WordPress Plugin Epeken All Kurir versions = 2.1.2...

WordPress affiliate-toolkit plugin <= 3.8.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 'orderby' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin affiliate-toolkit versions = 3.8.8...

WordPress Amelia plugin < 2.4.6 - Provider+ Cross-Customer Appointment Data Disclosure via IDOR vulnerability

Provider+ Cross-Customer Appointment Data Disclosure via IDOR vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Amelia versions 2.4.6...

WordPress Fluent Forms plugin <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values vulnerability

Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values vulnerability discovered by Adrien Brunner in WordPress Plugin FluentForm versions = 6.2.11...

WordPress Prevent Direct Access - Protect WordPress Files plugin <= 2.8.8.8 - Unauthenticated Protected File Access vulnerability

WordPress Prevent Direct Access - Protect WordPress Files plugin = 2.8.8.8 - Unauthenticated Protected File Access vulnerability discovered by Lucas Montes NiRoX in WordPress Plugin Prevent Direct Access versions = 2.8.8.8...

WordPress Quick PayPal Payments plugin <= 5.7.50 - Unauthenticated Payment Bypass via PayPal IPN vulnerability

Unauthenticated Payment Bypass via PayPal IPN vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Quick Paypal Payments versions = 5.7.50...

WordPress Welcart e-Commerce plugin < 2.11.33 - Unauthenticated Payment Bypass via Forged Settlement Callback vulnerability

Unauthenticated Payment Bypass via Forged Settlement Callback vulnerability discovered by Pedro Pinho in WordPress Plugin Welcart e-Commerce versions 2.11.33...

WordPress Wallet System for WooCommerce plugin < 2.7.10 - Customer+ Checkout Price Manipulation via Unvalidated Wallet Amount vulnerability

Customer+ Checkout Price Manipulation via Unvalidated Wallet Amount vulnerability discovered by takuma in WordPress Plugin Wallet System for WooCommerce versions 2.7.10...

WordPress Royal Elementor Addons plugin < 1.7.1065 - Contributor+ Stored XSS via Icon Box Widget vulnerability

Contributor+ Stored XSS via Icon Box Widget vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Royal Elementor Addons versions 1.7.1065...

WordPress Order Sync with Zendesk for WooCommerce plugin < 2.2.3 - Unauthenticated Customer Order Data Disclosure vulnerability

Unauthenticated Customer Order Data Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Order Sync with Zendesk for WooCommerce versions 2.2.3...

WordPress ProSolution WP Client plugin < 2.0.9 - Subscriber+ proSol_ajaxTablesync and proSol_ajaxClearlog Calls vulnerability

Subscriber+ proSolajaxTablesync and proSolajaxClearlog Calls vulnerability discovered by Nir Yehoshua in WordPress Plugin ProSolution WP Client versions 2.0.9...

WordPress WP Photo Album Plus plugin < 9.2.09.002 - Subscriber+ Cross-Album File Upload via Missing Authorization vulnerability

Subscriber+ Cross-Album File Upload via Missing Authorization vulnerability discovered by Farid Narimanov in WordPress Plugin WP Photo Album Plus versions 9.2.09.002...

CVE-2026-19794

The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...

CVE-2026-18039

The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom...

CVE-2026-14290

The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including...

CVE-2026-12949

The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpmregister function validating the registration cookie only against the GET reg parameter while accepting the...

CVE-2026-12743

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-14290 Embed Google Photos Album Easily <= 2.2.1 - Contributor+ Stored XSS via link Shortcode Attribute

The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including...

EUVD-2026-58595

The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including...

EUVD-2026-58598

The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom...