CVE-2026-14328 Eazy Plugin Manager <= 4.4.1 - Authenticated (Subscriber+) Privilege Escalation via pos_get_option AJAX Action and admin/login REST Endpoint

The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.1. This is due to insufficient authorization on the wpajaxposgetoption AJAX handler, which verifies only a nonce that is...

CVE-2026-14328

The CVE-2026-14328 entry describes a Privilege Escalation in the Eazy Plugin Manager for WordPress (up to version 4.4.1). The root cause is insufficient authorization on the wp_ajax_pos_get_option AJAX handler, which returns arbitrary WordPress options via get_option() after only a localized nonc...

CVE-2026-16462

The CVE concerns PROCON-WEB SCADA: the GetGridData endpoint is not properly sanitized, enabling a remote unauthenticated attacker to execute arbitrary SQL commands (SQL injection). This vulnerability has a CVSS 3.1/3.1 base score 9.8 (CRITICAL) and CVSS 4.0 score 9.3, indicating high impact to co...

EUVD-2026-49733

In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This allows a remote unauthenticated attacker to execute arbitrary SQL commands...

CVE-2026-12800

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied...

CVE-2026-9680 MCP Server Exposure via Insecure Default Binding on alibabacloud-rds-openapi-mcp-server

Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP endpoint listening on all network interfaces by default...

CVE-2026-9680

Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP endpoint listening on all network interfaces by default...

CVE-2026-12800 Premium Packages <= 6.2.0 - Unauthenticated SQL Injection

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied...

CVE-2026-12800

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied...

EUVD-2026-49723

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied...

CVE-2026-12800

The CVE-2026-12800 affects the Premium Packages – Sell Digital Products Securely plugin for WordPress (versions up to 6.2.0). A SQL Injection exists via the code parameter in the POST /wp-json/wpdmpp/v1/cart/coupon REST endpoint. Root cause: user-supplied code is interpolated directly into a raw ...

CVE-2026-14516

The Bookly WordPress plugin (Online Scheduling and Appointment Booking System) is affected by a time-based SQL Injection via the staff_ids parameter in all versions up to 27.5. Root cause: insufficient escaping of user input and inadequate preparation of the existing SQL query. Impact: unauthenti...

CVE-2026-14516

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staffids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

EUVD-2026-49703

The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the requesting customer in several of its payment-method endpoints, allowing any authenticated customer to act on another customer's subscription changing its payment method, or...

EUVD-2026-49689

The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax function and the serveTemplatePdf REST route which is registered...

CVE-2026-12124 PDFDraft <= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via 'slug' Parameter

The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax function and the serveTemplatePdf REST route which is registered...

CVE-2026-12124 PDFDraft <= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via 'slug' Parameter

The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax function and the serveTemplatePdf REST route which is registered...

CVE-2026-12124

The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax function and the serveTemplatePdf REST route which is registered...

Exploit for CVE-2026-8206

CVE-2026-8206 Vulnerability: Unauthenticated Account Takeo...

PT-2026-65412

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied...