EUVD-2026-51712

The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypass the vote limit and cast unlimited votes on a public poll...

CVE-2026-14214

The Booking for Appointments and Events Calendar WordPress plugin, in versions before 2.4.4 , is vulnerable to an arbitrary user-field modification flaw via mass assignment . The plugin fails to restrict which fields can be written during its customer import process. This allows a user with the A...

CVE-2026-13725

The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin (versions before 5.0.0 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is a failure to validate a nonce or user capabilities on one of its AJAX actions, combined with the reflection of unsanitised us...

EUVD-2026-51699

The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds, allowing any authenticated user, including Subscribers, to trigger refunds against captured orders...

CVE-2026-12966 Direct Payments for WooCommerce < 2.5.3 - Unauthenticated Cross-Customer Order Tampering via digages AJAX Actions

The Direct Payments for WooCommerce WordPress plugin before 2.5.3 does not verify that the requester owns the targeted WooCommerce order in several unauthenticated AJAX handlers before changing its status and overwriting its payment metadata, allowing unauthenticated attackers to tamper with othe...

PT-2026-67039

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request...

PT-2026-66998

The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, allowing high-privilege users such as administrators, who do not hold the unfiltered html capability on multisite to store JavaScript that...

PT-2026-67121

The Easy Property Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'facebook' User Contact Method in all versions up to, and including, 3.5.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress NEX-Forms – Ultimate Forms Plugin for WordPress plugin <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion vulnerability

Authenticated Admin+ Arbitrary File Deletion vulnerability discovered by Wordfence PRISM in WordPress Plugin NEX-Forms versions = 9.2.3...

WordPress Download Manager plugin <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Download Manager versions = 3.3.66...

WordPress ProfileGrid plugin < 5.9.9.8 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin ProfileGrid versions 5.9.9.8...

CVE-2026-14862 Support Genix Lite < 1.4.48 - Unauthenticated Ticket Attachment Download via Missing Authorization

The Support Genix WordPress plugin before 1.4.48 does not properly authorize access to support-ticket attachment downloads, allowing unauthenticated users who obtain the stored attachment file name to download other users' private ticket attachments...

PT-2026-66704

The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in the uploads directory, allowing unauthenticated users to download the exported member and payment data including PII while an export artifact...

WordPress Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin <= 6.2.8 - Unauthenticated Sensitive Information Exposure vulnerability

Unauthenticated Sensitive Information Exposure vulnerability discovered by ChinhNguyen in WordPress Plugin FluentForm versions = 6.2.8...

WordPress Cost Calculator Builder PRO plugin <= 4.0.3 - Unauthenticated Remote Code Execution vulnerability

Unauthenticated Remote Code Execution vulnerability discovered by Nox Axter in WordPress Plugin Cost Calculator Builder Pro versions = 4.0.3...

WordPress SAML Single Sign On – SSO Login plugin <= 5.4.4 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Supakiad S. m3ez in WordPress Plugin SAML SP Single Sign On versions = 5.4.4...

EUVD-2026-51011

The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it, allowing users with Contributor-level access and above to inject JavaScript that will be executed Stored Cross-Site Scripting when the page...

WordPress LifterLMS plugin < 10.0.10 - Subscriber+ Sensitive Information Disclosure vulnerability

Subscriber+ Sensitive Information Disclosure vulnerability discovered by Daniel Púa - devploit in WordPress Plugin LifterLMS versions 10.0.10...

WordPress Easy Appointments plugin <= 3.12.26 - Contributor+ Appointment Data Disclosure & Modification vulnerability

Contributor+ Appointment Data Disclosure & Modification vulnerability discovered by Youssef massoudi in WordPress Plugin Easy Appointments versions = 3.12.26...

PT-2026-66394

The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated user with a low-privileged account Subscriber and above to read the personal data, including name...