EUVD-2026-49251

Administrator Arbitrary File Deletion in Easy Digital Downloads = 3.6.9 versions...

CVE-2026-59557

CVE-2026-59557 relates to the WordPress Events Made Easy plugin, affected versions

CVE-2026-59557 WordPress Events Made Easy plugin <= 3.1.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Events Made Easy = 3.1.3 versions...

CVE-2026-59557

Unauthenticated Broken Access Control in Events Made Easy = 3.1.3 versions...

EUVD-2026-49224

Unauthenticated Broken Access Control in Events Made Easy = 3.1.3 versions...

CVE-2026-59557 WordPress Events Made Easy plugin <= 3.1.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Events Made Easy = 3.1.3 versions...

WordPress Easy Digital Downloads plugin <= 3.6.9 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Easy Digital Downloads versions = 3.6.9...

PT-2026-64971

Administrator Arbitrary File Deletion in Easy Digital Downloads = 3.6.9 versions...

CVE-2026-66476: Improper Limitation of a Pathname to a Restricted Directory

Administrator Arbitrary File Deletion in Easy Digital Downloads = 3.6.9 versions...

CVE-2026-59557: Missing Authorization

Unauthenticated Broken Access Control in Events Made Easy = 3.1.3 versions...

PT-2026-64943

Unauthenticated Broken Access Control in Events Made Easy = 3.1.3 versions...

CVE-2025-50455

SQL injection vulnerability exists in the orderby parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments = 1.5.1. The vulnerability arises from unsanitized user input passed to the orderby method of the CodeIgniter Query Builder, enabling attackers to perform time-based...

Exploit for CVE-2026-61946

CVE-2026-61946: One Appointment ID to Somebody Else's Booking...

CVE-2026-8789

The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the eadeletemultipleconnections AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated...

CVE-2026-8789

The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the eadeletemultipleconnections AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated...

CVE-2026-8789

The Easy Appointments WordPress plugin is vulnerable to unauthorized data modification via the ea_delete_multiple_connections AJAX action, due to a missing capability check and missing nonce verification in all versions up to 3.12.27. Authenticated attackers with Contributor-level access and abov...

EUVD-2026-48600

The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the eadeletemultipleconnections AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated...

CVE-2026-8789 Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Arbitrary Connection Deletion

The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the eadeletemultipleconnections AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated...

WordPress Events Made Easy plugin <= 3.1.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by HieuPenguinnn in WordPress Plugin Events Made Easy versions = 3.1.3...

CVE-2026-8789: Incorrect Authorization

The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the eadeletemultipleconnections AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated...