CVE-2026-19782

The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing any authenticated user, such as a subscriber, to retrieve the email addresses of all registered users...

CVE-2026-18777

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification emails to the affected customers...

CVE-2026-18466

The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request...

CVE-2026-55593

Froxlor versions before 2.3.8 are vulnerable to CSRF: the standalone lib/ajax.php endpoint bypasses centralized validation in lib/init.php, and the editapikey action in Ajax::editApiKey modifies API key allowed_from/valid_until without a CSRF token. An attacker can forge requests via an authentic...

CVE-2026-13424

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via booklyspeedupupdateaddons AJAX action in all versions up to, and including, 27.7 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-13424

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via booklyspeedupupdateaddons AJAX action in all versions up to, and including, 27.7 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-18432

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...

CVE-2026-13167 Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

EUVD-2026-59849

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...

CVE-2026-18432 Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...

CVE-2026-18432

CVE-2026-18432 affects the Frontend Admin by DynamiApps plugin for WordPress (≤ 3.29.9). The flaw stems from ActionUser::conditions_logic() gating the current_user_can('edit_user', $user_id) check behind is_numeric(), so a non-numeric string (e.g., 1one) can bypass authorization when supplied via...

CVE-2026-18432 Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...

PT-2026-73100

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditions logic gates the current user can'edit user', $user id authorization check behind an is numeric test,...

EUVD-2026-59587

The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, allowing unauthenticated users to retrieve the rendered content of unpublished private, draft, pending documents by supplying thei...

CVE-2026-15993

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via 'username' Placeholder in Dynamic-Choice Field WHERE Clause in all versions up to, and including, 1.15.44 due to insufficient escaping on the user supplied...

CVE-2026-15993 Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via 'username' Placeholder in Dynamic-Choice Field WHERE Clause in all versions up to, and including, 1.15.44 due to insufficient escaping on the user supplied...

CVE-2026-15993

The Form Maker by 10Web WordPress plugin (vulnerable up to 1.15.44) is affected by a blind SQL Injection in the Dynamic-Choice Field WHERE clause that references the {username} placeholder. Root cause: insufficient escaping of the user-supplied parameter and inadequate preparation of the existing...

CVE-2026-15001

The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX actions savebloyalconfigurationdata and savebloyalaccesskeyverificationdata being registered without any capability or...

PT-2026-72153

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via 'username' Placeholder in Dynamic-Choice Field WHERE Clause in all versions up to, and including, 1.15.44 due to insufficient escaping on the user supplied...

WordPress ProSolution WP Client plugin < 2.0.9 - Subscriber+ proSol_ajaxTablesync and proSol_ajaxClearlog Calls vulnerability

Subscriber+ proSolajaxTablesync and proSolajaxClearlog Calls vulnerability discovered by Nir Yehoshua in WordPress Plugin ProSolution WP Client versions 2.0.9...