CVE-2026-12739: Missing Authorization

The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-87966: Authorization Bypass Through User-Controlled Key

The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and...

PT-2026-95248

Name of the Vulnerable Software and Affected Versions Easy Appointments versions 4.0 through 4.0.2.1 Description The plugin fails to perform ownership or authorization checks on the unauthenticated appointment-reservation endpoint. This allows unauthenticated attackers to overwrite or delete...

CVE-2026-85123: Improper Access Control

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to create WordPress accounts on a site whose owner has disabled registration...

CVE-2026-85122: Improper Neutralization of Input During Web Page Generation

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to store arbitrary content which is then rendered unescaped in an admin page, leading to Stored XSS...

CVE-2026-87965: Improper Access Control

The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation action, deriving the token from a hardcoded source-embedded salt and the appointment's creation timestamp, so unauthenticated attackers who...

PT-2026-95281

Name of the Vulnerable Software and Affected Versions WP Easy Pay – Payment and Donation form Builder for Square versions prior to 4.5.1 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated...

WordPress WP Easy Pay – Payment and Donation Form Builder for Square plugin <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Post Deletion vulnerability discovered by Wordfence PRISM in WordPress Plugin WP EasyPay versions = 4.5.0...

WordPress Easy Booking plugin < 3.5.0 - Unauthenticated Minimum Booking Duration Bypass vulnerability

Unauthenticated Minimum Booking Duration Bypass vulnerability discovered by marim00 in WordPress Plugin Easy Booking – WooCommerce Booking & Reservation Plugin versions 3.5.0...

CVE-2026-66676

Unauthenticated Broken Access Control in Easy Invoice = 2.3.8 versions...

CVE-2026-66676

CVE-2026-66676 is an unauthenticated Broken Access Control vulnerability in the WordPress Easy Invoice plugin, affecting versions 2.3.8 and below . The vulnerability was discovered by Rahul Yadav and allows a remote attacker to access data with low confidentiality impact (CVSS 3.1: 5.3 MEDIUM ). ...

EUVD-2026-81512

Unauthenticated Broken Access Control in Easy Invoice = 2.3.8 versions...

CVE-2026-66676 WordPress Easy Invoice plugin <= 2.3.8 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Easy Invoice = 2.3.8 versions...

CVE-2026-66676 WordPress Easy Invoice plugin <= 2.3.8 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Easy Invoice = 2.3.8 versions...

PT-2026-94278

Unauthenticated Broken Access Control in Easy Invoice = 2.3.8 versions...

CVE-2026-66676: Missing Authorization

Unauthenticated Broken Access Control in Easy Invoice = 2.3.8 versions...

WordPress Easy Invoice plugin <= 2.3.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rahul Yadav in WordPress Plugin Easy Invoice versions = 2.3.8...

Exploit for CVE-2026-15253

CVE-2026-15253 Easy Media Replace = 0.2.0 - Authenticated Au...

Easy Media Replace 0.2.0 Cross Site Scripting

Easy Media Replace version 0.2.0 and below suffer from a persistent cross site scripting vulnerability. https://packetstorm.news/download/231132...

CVE-2026-4657

The Easy Google Fonts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the controlselectors meta field in all versions up to, and including, 2.0.4. This is due to the plugin registering the controlselectors meta field with showinrest enabled but without a sanitizecallback, an...