CVE-2026-15906

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...

CVE-2026-15786

The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.8.6.6 via the 'imploded' parameter parameter. This makes it possible for authenticated attackers, with...

CVE-2026-15404

The Lpagery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.5.7. This is due to insufficient input sanitization and output escaping in the lpageryaddfiltertexttemplatepost function, which is hooked to adminfooter and echoes the...

CVE-2026-13119

The Registrations For The Events Calendar plugin for WordPress is vulnerable to SQL Injection via JSON keys in the 'standard' parameter handled by the rtecrecordsedit AJAX action in versions up to and including 3.2. The handler decodes attacker-controlled JSON from $POST'standard' and uses the JS...

CVE-2026-15015 MountDev AI MCP Connector for WordPress <= 1.6.1 - Unauthenticated Privilege Escalation via OAuth Authorization Endpoint

The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers...

CVE-2026-15786

CVE-2026-15786 affects the WordPress plugin “WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan.” All versions up to 7.8.6.6 are vulnerable to Directory Traversal via the “imploded” parameter. With administrator-level access, an authenticated attacker could...

CVE-2026-15786

The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.8.6.6 via the 'imploded' parameter parameter. This makes it possible for authenticated attackers, with...

CVE-2026-15348 Premium Packages <= 7.0.4 - Authentication Bypass to Non-Admin via 'wpdmppdl' Parameter

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the wpdmppdl parameter. This is due to the download function — hooked to the unauthenticated WordPress wp action — decoding the...

EUVD-2026-47900

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the wpdmppdl parameter. This is due to the download function — hooked to the unauthenticated WordPress wp action — decoding the...

CVE-2026-15348 Premium Packages <= 7.0.4 - Authentication Bypass to Non-Admin via 'wpdmppdl' Parameter

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the wpdmppdl parameter. This is due to the download function — hooked to the unauthenticated WordPress wp action — decoding the...

CVE-2026-15348

The CVE affects the WordPress plugin Premium Packages – Sell Digital Products Securely up to version 7.0.4 . The vulnerability arises in the download() function, which is hooked to the unauthenticated WordPress wp action and decodes the attacker-controlled wpdmppdl parameter with only base64_deco...

CVE-2026-15348

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the wpdmppdl parameter. This is due to the download function — hooked to the unauthenticated WordPress wp action — decoding the...

CVE-2026-64871 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension - Administrator URL purges did not consistently require a valid token and cache-management permission...

CVE-2026-64871

The Joomla Extension Cache Cleaner by regularlabs.com is vulnerable to inconsistent CSRF token checks and privilege checks . Specifically, Administrator URL purges do not consistently require a valid token or proper cache-management permission . This could allow an attacker to perform unauthorize...

CVE-2026-64874 Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension

Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - CDN credentials were exposed in administrator request URLs...

CVE-2026-64874

The Cache Cleaner Pro extension for Joomla (by regularlabs.com) is vulnerable to CDN credential leakage . The root cause is that CDN credentials are exposed within administrator request URLs , which could allow an unauthorized actor to gain access to the Content Delivery Network configuration. No...

CVE-2026-15906

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...

EUVD-2026-47922

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...

CVE-2026-15906 Premium Packages <= 7.0.4 - Authenticated (Admin+) SQL Injection via 'orderby' Parameter

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...

CVE-2026-15761 Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_event_filter' Parameter

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tceventfilter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...