EUVD-2026-60807

Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...

CVE-2026-73404

Subscriber users of MasterStudy LMS plugin

CVE-2026-73404 WordPress MasterStudy LMS plugin <= 3.7.41 - Broken Access Control vulnerability

Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...

CVE-2026-73404

Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...

EUVD-2026-60804

Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions...

CVE-2026-73399 WordPress Flutterwave WooCommerce plugin <= 3.3.0 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Flutterwave WooCommerce = 3.3.0 versions...

CVE-2026-73396

The MWB HubSpot for WooCommerce plugin (≤1.6.7) has a broken authentication flaw exploitable by any logged-in subscriber over the network with low complexity, causing high availability impact and low integrity impact (CVSS 7.1); upgrading beyond 1.6.7 is recommended. Patchstack advisory: https://...

CVE-2026-73397

Unauthenticated Deserialization of untrusted data in Youzify = 1.3.7 versions...

CVE-2026-73395

The WordPress plugin Booking calendar, Appointment Booking System (versions ≤ 3.2.36) has an unauthenticated IDOR flaw, discovered by Jakub Herman, allowing remote attackers to access or modify objects without authentication. CVSS 3.1 scores 6.5 (Medium) with no in-the-wild exploitation reported....

CVE-2026-73395

Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...

CVE-2026-73392

Unauthenticated SQL Injection in Super Store Finder = 7.8 versions...

EUVD-2026-60798

Shop manager Arbitrary File Download in CTX Feed = 6.6.47 versions...

CVE-2026-73381 WordPress Popup by Supsystic plugin <= 1.13.0 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Popup by Supsystic = 1.13.0 versions...

EUVD-2026-60795

Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...

CVE-2026-73381

Unauthenticated Broken Authentication in Popup by Supsystic = 1.13.0 versions...

EUVD-2026-60794

Unauthenticated Bypass Vulnerability in Contact Form by Supsystic 1.10.0 versions...

CVE-2026-73379

Unauthenticated Bypass Vulnerability in Contact Form by Supsystic 1.10.0 versions...

CVE-2026-73378

Unauthenticated Cross Site Scripting XSS in Contact Form by Supsystic 1.10.0 versions...

CVE-2026-73378

An unauthenticated Cross-Site Scripting (XSS) vulnerability exists in the WordPress "Contact Form by Supsystic" plugin versions below 1.10.0, allowing remote attackers to inject malicious scripts that execute in users' browsers. CVSS 3.1 scores it HIGH (7.1). Upgrade to version 1.10.0 or later. N...

CVE-2026-73377

The Ultimate Maps by Supsystic WordPress plugin (versions below 1.5.0) has an unauthenticated broken access control flaw allowing remote attackers to perform unauthorized actions with high integrity impact; no exploitation is reported in the provided documents.