CVE-2026-108073

The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API, nor strip private fields from those objects, allowing unauthenticated users to read merchant-private catalog data such as...

CVE-2026-102499

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL...

Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion

A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization. According to a report published by Russian cybersecurity firm Solar, the activity has been attributed to a threat cluster dubbed Partisan Zmiy , which is also known as the Cyber...

CVE-2026-92999 Click n Chat 1.0.4 - 1.1.2 - Unauthenticated Lead Data Disclosure via click_n_chat_update_lead_list_export_action

The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not perform any authorization check on a lead-export handler, allowing unauthenticated users to download every captured contact record names, email addresses and phone numbers...

WordPress Click n Chat (Chat Widget Integration) plugin 1.0.4-1.1.2 - Unauthenticated Lead Data Disclosure vulnerability

Unauthenticated Lead Data Disclosure vulnerability discovered by Mokksh Parekh in WordPress Plugin Click n Chat Chat Widget Integration versions 1.0.4-1.1.2...

CVE-2026-92999 Click n Chat 1.0.4 - 1.1.2 - Unauthenticated Lead Data Disclosure via click_n_chat_update_lead_list_export_action

The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not perform any authorization check on a lead-export handler, allowing unauthenticated users to download every captured contact record names, email addresses and phone numbers...

CVE-2026-92999

The Click n Chat (Chat Widget Integration) WordPress plugin, in versions 1.0.4 through 1.1.2 , is vulnerable to an unauthenticated lead data disclosure vulnerability. The root cause is a lack of authorization checks on a lead-export handler, specifically via the click_n_chat_update_lead_list_expo...

CVE-2026-111956

The WholesaleX WordPress plugin versions prior to 3.0.9 contains a vulnerability where it fails to protect or remove the user-import file . This file is stored in a publicly accessible location using a predictable name, which allows unauthenticated users to download the most recently imported use...

CVE-2026-111956 WholesaleX < 3.0.9 - Unauthenticated Imported User CSV Disclosure

The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact a...

CVE-2026-111956 WholesaleX < 3.0.9 - Unauthenticated Imported User CSV Disclosure

The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact a...

CVE-2026-111596 Kliken: Ads + Pixel for Meta < 1.2.3 - Unauthenticated Order Data Disclosure via IDOR

The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unauthenticated users to retrieve the billing location, purchased products and totals of other...

CVE-2026-111596 Kliken: Ads + Pixel for Meta < 1.2.3 - Unauthenticated Order Data Disclosure via IDOR

The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unauthenticated users to retrieve the billing location, purchased products and totals of other...

WordPress Kliken: Ads + Pixel for Meta plugin < 1.2.3 - Unauthenticated Order Data Disclosure vulnerability

Unauthenticated Order Data Disclosure vulnerability discovered by Huseyn in WordPress Plugin Kliken: Ads + Pixel for Meta versions 1.2.3...

CVE-2026-111596

The Kliken: Ads + Pixel for Meta WordPress plugin, in versions before 1.2.3 , is vulnerable to an unauthenticated order data disclosure due to an Insecure Direct Object Reference (IDOR) . The application fails to verify that a visitor possesses a specific order's key before displaying order detai...

CVE-2026-108073 SureCart < 4.9.5 - Unauthenticated Private Catalog Data Disclosure via 'expand' Parameter

The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API, nor strip private fields from those objects, allowing unauthenticated users to read merchant-private catalog data such as...

EUVD-2026-107065

The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API, nor strip private fields from those objects, allowing unauthenticated users to read merchant-private catalog data such as...

CVE-2026-108073

The SureCart WordPress plugin, in versions prior to 4.9.5 , is vulnerable to an unauthenticated private catalog data disclosure. The root cause is that the plugin fails to restrict related objects or strip private fields when an anonymous visitor reads a single upsell funnel via the REST API . Th...

CVE-2026-108073 SureCart < 4.9.5 - Unauthenticated Private Catalog Data Disclosure via 'expand' Parameter

The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API, nor strip private fields from those objects, allowing unauthenticated users to read merchant-private catalog data such as...

WordPress SureCart plugin < 4.9.5 - Unauthenticated Private Catalog Data Disclosure vulnerability

Unauthenticated Private Catalog Data Disclosure vulnerability discovered by cyberkareem in WordPress Plugin SureCart versions 4.9.5...

EUVD-2026-107054

The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriving them instead from values it exposes publicly, so an unauthenticated attacker can reconstruct an arbitrary booking's token, disclose that booking's persona...