CVE-2026-105989 Accept PayPal Payments using Contact Form 7 < 4.0.7 - Unauthenticated Transaction Status Forgery

The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments...

PT-2026-107830

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any...

CVE-2026-97227: Missing Authorization

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonce alone, allowing users an administrator has granted access to its posting features to export the site's configured social...

PT-2026-99252

Name of the Vulnerable Software and Affected Versions The Testimonials Widget WordPress plugin versions prior to 4.0.5 Description The plugin fails to perform capability or ownership checks when processing the front-end testimonial submission form. This allows unauthenticated users to create...

CVE-2026-87848

The MPCX Lightbox WordPress plugin (versions 1.2.2 through 1.2.5 ) is vulnerable to unauthenticated non-public post content disclosure. The root cause is a lack of authorisation or authentication on one of its AJAX actions , combined with a failure to check the status of the requested post. Conse...

CVE-2026-86802

To Do List Member is a WordPress plugin that allows unauthenticated users to create arbitrary published posts and taxonomy terms due to missing authorization and nonce checks in its import routine. The plugin also fails to validate the source location it fetches imported data from, enabling unaut...

CVE-2026-86802 To Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via Import

The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site...

CVE-2026-1242

The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to the use of an AND && operator instead of an OR || operator. This makes it possible for authenticated attackers, with...

EUVD-2026-83541

The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to the use of an AND && operator instead of an OR || operator. This makes it possible for authenticated attackers, with...

CVE-2026-1242: Incorrect Authorization

The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to the use of an AND && operator instead of an OR || operator. This makes it possible for authenticated attackers, with...

PT-2026-95774

Name of the Vulnerable Software and Affected Versions BlockSpare versions prior to 4.2.7 Description The BlockSpare plugin for WordPress contains an authorization bypass flaw caused by incorrect logic within the permission callback. The issue stems from the use of an AND && operator instead of an...

CVE-2026-81428 WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Product and Arbitrary Post Modification via IDOR

The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitra...

CVE-2026-19077

The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site...

CVE-2026-19077

The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site...

EUVD-2026-55000

The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site...

PT-2026-69382

Name of the Vulnerable Software and Affected Versions Duplicate Post WordPress plugin versions prior to 1.5.5 Description Insufficient per-object authorization checks in bulk copy and delete operations allow users with assigned plugin access to permanently delete arbitrary posts on the site,...

CVE-2026-16965

The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber and, via CSRF, any logged-in user to update post meta on arbitrary posts and to deactivate the site's active templates...

CVE-2026-7105

CVE-2026-7105 affects the WordPress plugin Xpro Addons up to version 1.5.1. The root cause is a missing capability check in the get_menu_content_editor() function, allowing authenticated users with Subscriber+ privileges to create arbitrary published posts of the xpro_content CPT. The created pos...

CVE-2026-16057

The Contest Gallery WordPress plugin (versions prior to 30.0.7 ) is vulnerable to arbitrary post deletion due to the post_cg_youtube_delete_from_library handler. The plugin fails to perform per-object capability or nonce checks , relying instead on a coarse role-membership test. This allows any u...

CVE-2026-16057 Contest Gallery < 30.0.7 - Author+ Arbitrary Post Deletion via post_cg_youtube_delete_from_library

The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other...