CVE-2026-7753

The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check on the cost-calculator-custom-export-run AJAX action handler CCBExportImport::exportcalculators in all versions up to, and including, 3.6.17. The handler only...

CVE-2026-15230 YayPricing < 3.5.7 - Subscriber+ Pricing Configuration Modification and Coupon Code Disclosure

The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its REST API routes, relying only on a shared nonce, allowing any authenticated user such as a subscriber to overwrite the store's pricing configuration and to disclose private coupon codes...

EUVD-2026-53116

The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its REST API routes, relying only on a shared nonce, allowing any authenticated user such as a subscriber to overwrite the store's pricing configuration and to disclose private coupon codes...

CVE-2026-16583 Orbit Fox by ThemeIsle < 3.0.8 - Author+ Stored XSS via SVG Upload

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.8 does not sanitize uploaded SVG files when its SVG upload feature is enabled, allowing authenticated users with the upload capability Author and above by default, without the...

CVE-2026-16583

The Orbit Fox WordPress plugin, versions before 3.0.8 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to sanitize uploaded SVG files when the plugin's SVG upload feature is enabled. This allows authenticated users with upload capabilities (such as Author level a...

CVE-2026-7753

The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check on the cost-calculator-custom-export-run AJAX action handler CCBExportImport::exportcalculators in all versions up to, and including, 3.6.17. The handler only...

CVE-2026-7753 Cost Calculator Builder <= 3.6.17 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure

The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check on the cost-calculator-custom-export-run AJAX action handler CCBExportImport::exportcalculators in all versions up to, and including, 3.6.17. The handler only...

CVE-2026-11421

CVE-2026-11421 affects the ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support WordPress plugin. All versions up to 1.17.4 are vulnerable to authenticated SQL Injection via the erpadvancefilter parameter due to insufficient escaping and direct interpolation into a single-quoted ...

PT-2026-68223

Name of the Vulnerable Software and Affected Versions Neo4j affected versions not specified Description An issue exists in the Bolt modern handshake decoder where an overlong capability bit mask is treated identically to a truncated bit mask. An unauthenticated client can trigger this by sending ...

PT-2026-67944

Name of the Vulnerable Software and Affected Versions Relevanssi affected versions not specified Description The plugin includes an Admin Search page that enables users with the edit posts capability to perform searches from the WordPress dashboard. An AJAX handler accepts a URL-encoded args...

PT-2026-68172

Name of the Vulnerable Software and Affected Versions Udimi Tools versions prior to 3.3 Description The Udimi Tools plugin for WordPress allows authenticated users with Subscriber-level access and above to perform unauthorized data modifications. This is caused by missing capability checks in the...

PT-2026-68027

Name of the Vulnerable Software and Affected Versions Material Dashboard plugin for WordPress versions prior to 1.4.11 Description Missing capability checks in the amd ajax target task manager function allow unauthenticated attackers to access and modify data. This issue enables the enumeration o...

PT-2026-68467

Name of the Vulnerable Software and Affected Versions Accelerate versions prior to 1.5.4 Description The Accelerate theme for WordPress allows unauthorized modification of data because the enqueue scripts function lacks a proper capability check. This flaw enables authenticated users with...

CVE-2026-14587: Improper Handling of Length Parameter Inconsistency

Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability mask, the decoder resets the reader index and waits for mo...

CVE-2026-7520: Missing Authorization

The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the signin and signup AJAX handlers in all versions up to, and including, 3.2.7. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2026-7105: Missing Authorization

The Xpro Addons plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on the getmenucontenteditor function in all versions up to, and including, 1.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2026-6627: Missing Authorization

The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unauthorized modification and deletion of Stripe payment credentials in all versions up to, and including, 1.1.1. This is due to missing capability checks and nonce verification on the...

CVE-2026-6079: Missing Authorization

The Material Dashboard plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the amdajaxtargettaskmanager function in all versions up to, and including, 1.4.10. This makes it possible for unauthenticated attackers to enumerate all...

CVE-2026-5581: Missing Authorization

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8. This is due to missing capability checks in the pluploadajaxdeletefile function, which is registered via wpajaxnoprivgfmudeletefile. The...

CVE-2026-4431: Missing Authorization

The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createpost function in all versions up to, and including, 2.3.0. This is due to the rbsmsubmitpost AJAX action being registered for unauthenticated users via...