CVE-2026-16600

CVE-2026-16600 affects the SmartAIPress WordPress plugin through 1.2.0 . The root cause is a missing capability check on the AJAX action smartaipress_openai_upload_and_set_featured_image, combined with the absence of URL validation before a server-side fetch. This allows any user with subscriber-...

EUVD-2026-68043

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external...

CVE-2026-16600 SmartAIPress <= 1.2.0 - Subscriber+ Server-Side Request Forgery via smartaipress_openai_upload_and_set_featured_image

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external...

CVE-2026-5934

The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.21.0.1. This is due to insufficient input sanitization and output escaping of user-supplied data via the rocketbeacon AJAX endpoint. This makes it possible for unauthenticated...

EUVD-2026-67711

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aggregated review form submission in versions up to and including 5.106.0. This is due to insufficient input sanitization and output escaping on user-supplied review comment text. The...

EUVD-2026-67709

The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.21.0.1. This is due to insufficient input sanitization and output escaping of user-supplied data via the rocketbeacon AJAX endpoint. This makes it possible for unauthenticated...

EUVD-2026-67464

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated wdpssostep1 and wdpssostep2 AJAX actions, where step 1 signs and disclose...

CVE-2026-16759

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutorcoursefilterajax AJAX action. This is due to missing authorization on the handler...

EUVD-2026-67406

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutorcoursefilterajax AJAX action. This is due to missing authorization on the handler...

VulnCheck KEV: CVE-2026-16759

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutorcoursefilterajax AJAX action. This is due to missing authorization on the handler...

PT-2026-83318

Name of the Vulnerable Software and Affected Versions geotargetingwp versions prior to 3.5.6.2 Description The plugin fails to sanitize or escape several parameters before reflecting them in AJAX responses served with an HTML content type. This allows unauthenticated attackers to perform reflecte...

CVE-2026-78138

The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user Subscriber and above to read the Finale Lite WordPress plugin before 2.21.0's campaign...

CVE-2026-13414

The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain and exposed to anonymous visitors on others, allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a...

CVE-2026-78138 Finale Lite < 2.21.0 - Subscriber+ Campaign Configuration Disclosure via wcct_quick_view_html

The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user Subscriber and above to read the Finale Lite WordPress plugin before 2.21.0's campaign...

CVE-2026-78138

CVE-2026-78138 is a missing capability check in the Finale Lite WordPress plugin (versions

EUVD-2026-66883

The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user Subscriber and above to read the Finale Lite WordPress plugin before 2.21.0's campaign...

EUVD-2026-66868

The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls to...

CVE-2026-13415 CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Privilege Escalation via cmp_ajax_import_settings

The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls to...

CVE-2026-13414

CVE-2026-13414 affects the CMP – Coming Soon & Maintenance WordPress plugin in versions before 4.1.18 . The vulnerability is an unauthenticated maintenance mode disable via the cmp_disable_comingsoon_ajax AJAX action. The plugin does not perform authorization checks on this action and relies on a...

CVE-2026-13414 CMP - Coming Soon & Maintenance < 4.1.18 - Unauthenticated Maintenance Mode Disable via cmp_disable_comingsoon_ajax

The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain and exposed to anonymous visitors on others, allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a...