CVE-2026-66476

Administrator Arbitrary File Deletion in Easy Digital Downloads = 3.6.9 versions...

CVE-2026-66476 WordPress Easy Digital Downloads plugin <= 3.6.9 - Arbitrary File Deletion vulnerability

Administrator Arbitrary File Deletion in Easy Digital Downloads = 3.6.9 versions...

CVE-2026-66476

CVE-2026-66476 affects WordPress with the Easy Digital Downloads plugin (≤ 3.6.9). The vulnerability is described as Administrator Arbitrary File Deletion in affected versions. The provided metrics indicate network access with high privileges required and UI none, resulting in high availability i...

EUVD-2026-49251

Administrator Arbitrary File Deletion in Easy Digital Downloads = 3.6.9 versions...

EUVD-2026-49240

Administrator SQL Injection in WP Google Review Slider = 18.4 versions...

CVE-2026-66427

Summary: CVE-2026-66427 affects the WordPress plugin “WP Google Review Slider” (

CVE-2026-59537

Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce = 2.10.22 versions...

CVE-2026-59537 WordPress Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin <= 2.10.22 - SQL Injection vulnerability

Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce = 2.10.22 versions...

CVE-2026-14189

The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator access to perform SQL injection that executes when a visitor triggers a search...

CVE-2026-12394

The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise...

CVE-2026-12255

The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account,...

EUVD-2026-49076

The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator access to perform SQL injection that executes when a visitor triggers a search...

CVE-2026-14189

The CVE covers the WPBot WordPress plugin prior to version 8.5.2. The root cause is failure to validate administrator-configured field identifiers before they are used in a SQL query, enabling a second-order SQL injection when a visitor triggers a search. The vulnerability can be exploited by use...

EUVD-2026-49073

The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the...

CVE-2026-13597

CVE-2026-13597 affects the WordPress plugin for 微信二维码登陆 (QR code login) versions

EUVD-2026-49070

The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions force-logout of any user on the site, including administrators...

CVE-2026-13332

The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions force-logout of any user on the site, including administrators...

CVE-2026-13152

The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table prefix, so an unauthenticated user who registers an account can be grant...

CVE-2026-13152

The CVE concerns the Custom Fields Account Registration For WooCommerce WordPress plugin, pre-1.4. The issue allows an unauthenticated user who registers an account to gain administrator privileges by writing to the user capabilities meta key on sites using a non-default database table prefix, if...

CVE-2026-13152 Custom Fields Account Registration For WooCommerce < 1.4 - Unauthenticated Privilege Escalation

The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table prefix, so an unauthenticated user who registers an account can be grant...