CVE-2026-7444

CVE-2026-7444 affects the WordPress plugin Search Analytics for WP (

CVE-2026-18881

CVE-2026-18881 affects the TableOn WordPress Posts Table Filterable plugin for WordPress, up to version 1.0.5.1. The vulnerability is a blind SQL injection in the public AJAX action tableon_get_table_data, triggered by the parameter filter_data[comment_count]. The value is split on ":" and interp...

CVE-2026-15281

The WordPress plugin User Access Manager (v

CVE-2026-5116

The vulnerability CVE-2026-5116 affects the WordPress plugin Contact Form 7 – Dynamic Text Extension (versions

CVE-2026-6079

Material Dashboard for WordPress (plugin) up to version 1.4.10 is vulnerable to missing authorization in the amd_ajax_target_task_manager() pathway, allowing unauthenticated attackers to enumerate all scheduled tasks, execute arbitrary tasks, and delete tasks via public_amd_ajax_handler. The unde...

CVE-2026-6627

WPFormify – Stripe Payments with Form and Checkout plugin for WordPress: CVE-2026-6627, all versions

CVE-2026-7726

The CVE describes an unauthenticated vulnerability in the WordPress plugin Layouts for WPBakery

CVE-2026-6639

The CVE concerns the AI Chatbot & Workflow Automation by AIWU WordPress plugin (

CVE-2026-5581

The CVE-2026-5581 entry concerns the WordPress plugin Multi Uploader for Gravity Forms . It is vulnerable in all versions up to and including 1.1.8 due to missing capability checks in the function plupload_ajax_delete_file() , which is registered via wp_ajax_nopriv_gfmu_delete_file . The CSRF-pro...

CVE-2026-5108

The CVE concerns the WordPress plugin Super Progressive Web Apps (versions

CVE-2026-49004

CVE-2026-49004 describes misconfiguration and command injection in the built-in PostgreSQL service on the mobile device (ZTE NX799J/Red Magic 11 Air). The service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGR...

CVE-2026-49004 PostgreSQL Misconfiguration and Command Injection Vulnerability in ZTE NX799J (Red Magic 11 Air) Product

The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGRAM syntax, allowing...

CVE-2026-16993

CVE-2026-16993 affects the DHL Shipping Germany for WooCommerce WordPress plugin, versions before 4.0.1. The issue arises because the plugin stores shipping labels in a directory that relies solely on an Apache .htaccess for access control. On servers that do not honor .htaccess (e.g., nginx), un...

CVE-2026-16981

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-16746

Technical details about CVE-2026-16746 are not publicly provided in the supplied documents. Monitor for updates from vendors and security advisories.

CVE-2026-16940

CVE-2026-16940 concerns the Custom Fields WordPress plugin prior to 1.5.1. The issue is a path traversal vulnerability that does not validate a user-supplied file path before deletion, allowing unauthenticated users to delete arbitrary files on the server (e.g., wp-config.php). This can lead to a...

CVE-2026-16968

The CVE describes a vulnerability in the GeoDirectory WordPress plugin (versions before 2.8.168) where a user-search handler does not enforce proper authorization. This allows any authenticated user with Contributor-level access or higher to retrieve the email addresses of all registered users, i...

CVE-2026-16602

CVE-2026-16602 affects the Passster WordPress plugin prior to version 4.3.6 . The issue arises because the plugin does not perform a post-status check when serving post content from an unauthenticated REST endpoint protected by a captcha provider, allowing unauthenticated users to disclose conten...

CVE-2026-16603

CVE-2026-16603 affects the Passster WordPress plugin prior to 4.3.6. The issue is that the plugin does not enforce category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts via the core REST AP...

CVE-2026-16604

The CVE-2026-16604 affects the Passster WordPress plugin prior to version 4.3.6. Affected behavior: unauthenticated users can access content that is supposed to be password-protected because protected block content is emitted in the public page response before password verification, via the conte...