CVE-2026-14314

The PeproDev WooCommerce Receipt Uploader WordPress plugin (versions

CVE-2026-70436

Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check 1.4.0 and earlier or performs an improper permission check 1.4.1 when providing access to externally-managed workspaces through the workspace browser, allowing attackers with Overall/Read permission to...

CVE-2026-70448

Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks when processing Ivy report files...

CVE-2026-70441

The Jenkins Summary Display Plugin (version 1.15 and earlier ) is vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause is a failure to escape the job name within a JavaScript context on build report pages. This vulnerability is exploitable by attackers who possess Item/...

CVE-2026-6639

The CVE concerns the AI Chatbot & Workflow Automation by AIWU WordPress plugin (

EUVD-2026-53119

The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator...

CVE-2026-16736 User Registration & Membership < 5.2.6 - Unauthenticated Account Creation While Registration Disabled

The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's registration-disabled setting when processing registration-form submissions, allowing unauthenticated users to create new accounts even when the administrator has turned off open registration...

WordPress Total Upkeep plugin <= 1.17.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Total Upkeep versions = 1.17.2...

CVE-2026-15939

The Simple Restrict WordPress plugin before 1.2.9 does not enforce its content-restriction permission check on the REST API the way it does on the front end, relying there on a generic capability check instead of the Simple Restrict WordPress plugin before 1.2.9's own permission system, allowing...

CVE-2026-13596 Participants Database < 2.7.8.4 - Unauthenticated SQL Injection via List Search

The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-14930

The JS Help Desk WordPress plugin (versions before 3.1.4 ) is vulnerable to an unauthenticated file upload flaw. The root cause is a lack of authorization , nonce , or ownership checks on a front-end request dispatcher. This allows unauthenticated users to upload files—restricted to the plugin's ...

CVE-2026-14847

The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of its payment-related AJAX actions, allowing any authenticated user with Subscriber-level access and above to disclose the payment details of any member by enumerating the payment...

SUSE CVE-2026-21388

Mattermost Plugins versions =2.3.1 fail to limit the request body size on the /lifecycle webhook endpoint which allows an authenticated attacker to cause memory exhaustion and denial of service via sending an oversized JSON payload. Mattermost Advisory ID: MMSA-2026-00610...

CLEANSTART-2026-TA14020 Security fixes in velero-plugin-for-aws 1.12.2-r5

Package velero-plugin-for-aws version 1.12.2-r5 fixes 8 vulnerabilities: CVE-2026-33811, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826...

WordPress SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover vulnerability

Unauthenticated Authentication Bypass to Account Takeover vulnerability discovered by Civitasmass in WordPress Plugin SMS Alert Order Notifications versions = 3.9.7...

CVE-2026-14226

The Easy Appointments WordPress plugin (versions before 3.12.28 ) contains a vulnerability where an appointment-listing REST endpoint fails to require a sufficient capability. It only checks for a capability held by every authenticated user, allowing users with subscriber-level access to view all...

PT-2026-66369

Name of the Vulnerable Software and Affected Versions WP Travel Engine versions prior to 6.8.2 Description The plugin fails to perform a capability check on an AJAX action used to update site-wide options. Because the public nonce intended to protect the action is served to anonymous visitors,...

WordPress 微信二维码登陆 plugin <= 1.3 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by João Ramos Maciel in WordPress Plugin 微信二维码登陆 versions = 1.3...

WordPress Klubraum Membership Request plugin <= 1.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update vulnerability

Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan in WordPress Plugin Klubraum Membership Request versions = 1.1.0...

WordPress WP Photo Album Plus plugin <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Photo Album Plus versions = 9.2.04.002...