EUVD-2026-60779

Unauthenticated Broken Access Control in GiveWP = 4.16.5.1 versions...

CVE-2026-73352 WordPress GiveWP plugin <= 4.16.5.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in GiveWP = 4.16.5.1 versions...

EUVD-2026-60777

Unauthenticated Broken Authentication in SupportCandy = 3.5.1 versions...

CVE-2026-73348 WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in GiveWP 4.16.6 versions...

CVE-2026-73348

GiveWP WordPress plugin versions before 4.16.6 have an unauthenticated broken access control flaw, allowing network-based attackers with no credentials to access restricted functionality (CVSS 6.5). Upgrade to 4.16.6 or later. No in-the-wild exploitation reported. Details: https://patchstack.com/...

CVE-2026-73348

Unauthenticated Broken Access Control in GiveWP 4.16.6 versions...

EUVD-2026-60776

Unauthenticated Broken Access Control in GiveWP 4.16.6 versions...

EUVD-2026-60775

Customer SQL Injection in License Manager for WooCommerce = 3.0.18 versions...

CVE-2026-73342

Unauthenticated Cross Site Scripting XSS in WP Multilang = 2.4.31 versions...

CVE-2026-73339 WordPress Modern Events Calendar plugin < 7.35.0 - SQL Injection vulnerability

Unauthenticated SQL Injection in Modern Events Calendar 7.35.0 versions...

CVE-2026-73189

The WordPress WP Crowdfunding plugin (versions below 2.2.1) has an IDOR vulnerability allowing authenticated subscribers to access other users' data via direct object references. Patchstack reports a CVSS 6.5 (MEDIUM) with HIGH confidentiality impact. Exploitation in the wild is not documented; u...

EUVD-2026-60939

Subscriber Insecure Direct Object References IDOR in WP Crowdfunding 2.2.1 versions...

CVE-2026-73189

Subscriber Insecure Direct Object References IDOR in WP Crowdfunding 2.2.1 versions...

CVE-2026-73187

The WordPress Sticky Chat Widget plugin (versions ≤ 1.4.2) contains an unauthenticated SQL Injection vulnerability, discovered by Nguyen Ba Khanh of HPT Vietnam Corporation. CVSS 3.1 scores it 9.3 (Critical) for network-exploitable high confidentiality impact. CISA SSVC rates it automatable with ...

Microsoft Copilot Information Disclosure Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to disclose information over a network...

CVE-2026-68568

Subscriber Privilege Escalation in MasterStudy LMS = 3.7.41 versions...

CVE-2026-66679 WordPress Appointment Hour Booking plugin <= 1.5.91 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Appointment Hour Booking = 1.5.91 versions...

CVE-2026-66679

Unauthenticated Broken Access Control in Appointment Hour Booking = 1.5.91 versions...

EUVD-2026-60933

Unauthenticated Broken Access Control in Appointment Hour Booking = 1.5.91 versions...

CVE-2026-66679

WordPress plugin Appointment Hour Booking (≤1.5.91) has an unauthenticated broken access control flaw, allowing network-based attackers to alter data or cause partial disruption. No in-the-wild exploitation is reported; updating to version 1.5.92+ is recommended.