CVE-2026-14526

The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to creat...

CVE-2026-16953

The CVE concerns the AI Engine WordPress plugin (before 3.6.4). The issue is that the plugin does not verify ownership of a guest’s uploaded chatbot files before deletion, authorising a delete action solely via a client-supplied session cookie. An unauthenticated attacker who obtains a victim’s s...

CVE-2026-16955

The CVE affects the AI Engine WordPress plugin, prior to version 3.6.6. The root cause is that the plugin does not confine a caller-supplied file path before reading it and forwarding the contents to an external service. This allows a subscriber-level user to read arbitrary files from the server ...

CVE-2026-16955

The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at...

CVE-2026-16948

The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and...

EUVD-2026-54745

The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at...

EUVD-2026-54739

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact messages and associated user data belonging to other users...

CVE-2026-16608

The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's...

CVE-2026-16608

The CVE covers the Download Monitor WordPress plugin, prior to version 5.2.6, where an unauthenticated AJAX endpoint used for download-logging lacks authorization checks and leaks its nonce to unauthenticated visitors. This enables unauthenticated users to inject arbitrary download log entries, i...

EUVD-2026-54736

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.11 does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST endpoints, allowing an authenticated vendor to grant...

CVE-2026-16574

CVE-2026-16574 affects the Dokan WordPress plugin (AI Powered WooCommerce Multivendor Marketplace Solution) prior to version 5.0.11. The root cause is a missing verification that a downloadable product belongs to the requesting vendor before granting download permissions via an order REST endpoin...

EUVD-2026-54735

The WP Statistics WordPress plugin before 14.16.10 does not perform a capability check on a set of dashboard analytics AJAX handlers, relying only on a nonce that every authenticated user holds, allowing users with Subscriber-level access and above to disclose the site's visitor analytics data...

EUVD-2026-54737

The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, ema...

CVE-2026-16574

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.11 does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST endpoints, allowing an authenticated vendor to grant...

CVE-2026-16559

The YMC Filter WordPress plugin (pre-3.12.9) fails to sanitize SVG uploads via its icon upload feature, allowing low-privilege users (Author role+) to upload SVGs containing JavaScript that executes in the site origin when viewed (Stored XSS). A fix is to update to version 3.12.9 or later; otherw...

EUVD-2026-54732

The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action...

CVE-2026-16562

CVE-2026-16562 – WP Statistics (WordPress) plugin before 14.16.10: the dashboard analytics AJAX handlers fail to perform a proper capability check, relying only on a nonce that is possessed by any authenticated user. This allows users with Subscriber-level access and higher to disclose visitor an...

CVE-2026-16578

The CVE-2026-16578 entry concerns the WordPress plugin Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection (pre-1.4.0). The issue is a missing capability check on a REST API endpoint (2fa/app/users), allowing unauthenticated access to the full user list, including user...

CVE-2026-16562

The WP Statistics WordPress plugin before 14.16.10 does not perform a capability check on a set of dashboard analytics AJAX handlers, relying only on a nonce that every authenticated user holds, allowing users with Subscriber-level access and above to disclose the site's visitor analytics data...

EUVD-2026-54729

The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects...