CVE-2026-118637 Simple Download Monitor < 4.1.3 - Contributor+ Private Download Item Title and Description Disclosure via [sdm_show_download_info] Shortcode

The Simple Download Monitor WordPress plugin before 4.1.3 does not properly check the visibility of the content referenced by one of its shortcodes, allowing users with a role as low as Contributor to disclose the title and description of private, draft and other non-public posts...

CVE-2026-118523 EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure via Public Post Status Override

The EventPrime WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public, allowing unauthenticated users to view posts, pages and other content that are awaiting review...

CVE-2026-115257 WP Roster < 2.36 - Unauthenticated Roster Data Modification

The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing unauthenticated attackers to overwrite, wipe or restore the content of any roster...

EUVD-2026-116729

The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing unauthenticated attackers to overwrite, wipe or restore the content of any roster...

CVE-2026-115257

The WP Roster WordPress plugin (versions before 2.36 ) is vulnerable to unauthenticated roster data modification. The root cause is a lack of capability or nonce checks before the plugin writes its stored roster data. This flaw allows an unauthenticated attacker to overwrite, wipe, or restore the...

CVE-2026-115262

The Duplicator and duplicator-pro WordPress plugins (versions before 5.1.0 ) are vulnerable to a SQL Injection flaw. The root cause is that the plugins fail to restrict database charset and collation rewrites to schema statements during a restore operation. A Subscriber can store a malicious valu...

CVE-2026-118404

The Premium Packages WordPress plugin (versions before 7.3.1 ) contains an IDOR vulnerability where it fails to verify ownership or session binding when loading previously saved shopping carts. This allows an unauthenticated user who obtains a valid saved-cart identifier to load another shopper's...

EUVD-2026-116726

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not sanitize the staging destination folder supplied to its staging-start handler, applying only a generic text filter while the sibling writability-check handler applies the correct filename sanitizer, so an...

CVE-2026-115241

The WPvivid — Backup, Migration & Staging WordPress plugin before version 0.9.137 is vulnerable to arbitrary database table deletion. The root cause is a failure to verify that a submitted snapshot identifier refers to a snapshot actually created by the user before using it as a database table-na...

CVE-2026-112244

The Duplicator and duplicator-pro WordPress plugins, in versions before 5.1.0 , are vulnerable to an unauthenticated full path disclosure . This issue occurs because the plugins do not prevent direct access to certain bundled PHP files. When these files are accessed outside of their expected cont...

EUVD-2026-116727

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it actually stores when handling an import upload: it checks the extension of a separate request field while saving the uploaded file itself with WordPress's upload type-checking...

CVE-2026-112244 Duplicator 5.0.0 - 5.0.6 - Unauthenticated Full Path Disclosure via Installer Entry Points

The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct access to some of its bundled PHP files, which initialise without their expected context, trigger a fatal error, and return a stack trace that discloses the server's absolute...

CVE-2026-115241 WPvivid Backup & Migration < 0.9.137 - Admin+ Arbitrary Database Table Deletion via Snapshot ID

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot identifier names a snapshot it actually created before using it as a database table-name prefix, so an authenticated administrator can supply the site's table prefix, or any other...

EUVD-2026-116725

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot identifier names a snapshot it actually created before using it as a database table-name prefix, so an authenticated administrator can supply the site's table prefix, or any other...

WordPress Enable Media Replace plugin < 4.2.3 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Adam Kahlon in WordPress Plugin Enable Media Replace versions 4.2.3...

CVE-2026-111962 WP Remote Users Sync < 2.2.0 - Unauthenticated Sensitive Data Disclosure via Public User Export File

The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately restrict access to the user export files it writes beneath the public web root, relying on an Apache access-control file that other web servers such as Nginx ignore, which allows an unauthenticated attacker who requests th...

EUVD-2026-116717

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform proper authorization checks on one of its video-migration functions, which is protected by a nonce only, allowing users with Contributor-level permissions and above to disclose and bulk-modify the FV Flowplayer...

EUVD-2026-116719

The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleting it, allowing a self-registered customer-level user to delete other users' media library attachments, including those owned by administrators...

CVE-2026-111740 Post Duplicator < 3.0.17 - Contributor+ Draft and Private Post Title Disclosure

The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private posts...

WordPress ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin < 1.17.11 - Subscriber+ Sensitive Data Disclosure vulnerability

Subscriber+ Sensitive Data Disclosure vulnerability discovered by cyberkareem in WordPress Plugin WP ERP versions 1.17.11...