CVE-2026-66679 WordPress Appointment Hour Booking plugin <= 1.5.91 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Appointment Hour Booking = 1.5.91 versions...

EUVD-2026-60933

Unauthenticated Broken Access Control in Appointment Hour Booking = 1.5.91 versions...

CVE-2026-66679

WordPress plugin Appointment Hour Booking (≤1.5.91) has an unauthenticated broken access control flaw, allowing network-based attackers to alter data or cause partial disruption. No in-the-wild exploitation is reported; updating to version 1.5.92+ is recommended.

EUVD-2026-60931

Unauthenticated Broken Access Control in MultiVendorX = 5.0.14 versions...

CVE-2026-66651

MultiVendorX WordPress plugin (versions ≤ 5.0.14) has an unauthenticated broken access control flaw. CVSS 6.5 (Medium) — network-reachable, no auth needed, low confidentiality and integrity impact. No patch version or exploit details provided; update once a fixed release is available. Monitor Pat...

CVE-2026-66651 WordPress MultiVendorX plugin <= 5.0.14 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in MultiVendorX = 5.0.14 versions...

CVE-2026-66651

Unauthenticated Broken Access Control in MultiVendorX = 5.0.14 versions...

CVE-2026-32549

Unauthenticated Broken Access Control in ThumbPress 6.5 versions...

CVE-2026-32549

The WordPress ThumbPress plugin (

CVE-2026-32549 WordPress ThumbPress plugin < 6.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in ThumbPress 6.5 versions...

EUVD-2026-60911

Unauthenticated Broken Access Control in ThumbPress 6.5 versions...

CVE-2026-32472 WordPress Online Contact Widget plugin <= 1.3.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Online Contact Widget = 1.3.0 versions...

CVE-2026-32472

Unauthenticated Broken Access Control in Online Contact Widget = 1.3.0 versions...

CVE-2026-32472

CVE-2026-32472 is an unauthenticated Broken Access Control vulnerability in the WordPress Online Contact Widget plugin, affecting versions ≤ 1.3.0 . The flaw allows an unauthenticated attacker to access data they should not be able to, resulting in high confidentiality impact with no integrity or...

EUVD-2026-60906

Unauthenticated Broken Access Control in Online Contact Widget = 1.3.0 versions...

CVE-2026-28571

The WordPress FormyChat plugin (versions ≤ 2.15.7) has an unauthenticated broken access control vulnerability exploitable over the network with no privileges, rated CVSS 7.5 (HIGH) with high confidentiality impact. No specific root cause, affected endpoint, or fix version is provided in the docum...

EUVD-2026-60896

Unauthenticated Broken Access Control in FormyChat = 2.15.7 versions...

CVE-2026-28571 WordPress FormyChat plugin <= 2.15.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in FormyChat = 2.15.7 versions...

CVE-2026-28571

Unauthenticated Broken Access Control in FormyChat = 2.15.7 versions...

EUVD-2026-60892

Unauthenticated Broken Access Control in WP Sort Order = 1.3.5 versions...