WordPress Datawiza Proxy Auth Plugin plugin < 1.1.1 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Datawiza Proxy Auth Plugin versions 1.1.1...

CVE-2026-103300 Eurobank WooCommerce Payment Gateway <= 2.1.1 - Unauthenticated Order Payment Forgery via Unverified Callback

The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that would authenticate it empty by default, allowing unauthenticated attackers to mark any pending...

CVE-2026-111974

The GiveWP WordPress plugin versions prior to 4.19.0.1 is vulnerable to an unauthenticated donation amount restriction bypass . The root cause is that the plugin fails to restrict the donation currency to the specific currency accepted by the site or form. Instead, it compares amount limits as ba...

CVE-2026-111974 GiveWP < 4.19.0.1 - Unauthenticated Donation Amount Restriction Bypass via Currency

The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form accepts, while comparing its amount limits as bare numbers, allowing unauthenticated users to make donations below a form's configured minimum or fixed amount...

CVE-2026-111974 GiveWP < 4.19.0.1 - Unauthenticated Donation Amount Restriction Bypass via Currency

The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form accepts, while comparing its amount limits as bare numbers, allowing unauthenticated users to make donations below a form's configured minimum or fixed amount...

Malicious Package

Overview dsh-plugin-blender-3d is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in dsh-plugin-blender-3d (npm)

[email protected] is a new release of a DeepSeek Harness plugin for Blender 3D modeling whose only change from 0.2.0 is a postinstall script, sh scripts/miner.sh, that runs on npm install. The script downloads a gzip carrier from amplify-gursha-dev-121835-deployment.s3.amazonaws.com to...

CVE-2026-103306

The Online Payments with iK Pay Gateway WordPress plugin (versions before 3.0.4 ) is vulnerable to an Unauthenticated Order Payment Forgery vulnerability. The flaw exists because the plugin fails to properly verify the authenticity of its payment gateway callback on a default installation. This a...

CVE-2026-103319

The OPay Payment Gateway for WooCommerce WordPress plugin (versions

CVE-2026-103319 OPay Payment Gateway for WooCommerce <= 2.5.5 - Unauthenticated Payment Confirmation Forgery via Empty Default Secret Key

The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid notification and...

CVE-2026-103306 iKhokha Payment Gateway < 3.0.4 - Unauthenticated Order Payment Forgery via Callback

The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation, allowing unauthenticated attackers to forge a successful payment notification and mark arbitrary orders as paid without any...

CVE-2026-103319 OPay Payment Gateway for WooCommerce <= 2.5.5 - Unauthenticated Payment Confirmation Forgery via Empty Default Secret Key

The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid notification and...

CVE-2026-116107

A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by this issue is the function dfrpsajaxdeletesavedsearch of the file functions/ajax.php of the component AJAX Handlers. The manipulation results in missing authorization. The attack may be launched...

WordPress Duplicator 1.3.24 & 1.3.26 - Local File Inclusion

WordPress Duplicator 1.3.24 & 1.3.26 are vulnerable to local file inclusion vulnerabilities that could allow attackers to download arbitrary files, such as the wp-config.php file. According to the vendor, the vulnerability was only in two versions v1.3.24 and v1.3.26, the vulnerability wasn't...

WordPress Chop Slider 3 - Blind SQL Injection

WordPress Chop Slider 3 plugin contains a blind SQL injection vulnerability via the id GET parameter supplied to getscript/index.php. The plugin can allow an attacker to execute arbitrary SQL queries in the context of the WP database user, thereby making it possible to obtain sensitive informatio...

Worpress Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote...

CVE-2026-116107 Datafeedr Product Sets Plugin AJAX Handlers ajax.php dfrps_ajax_delete_saved_search authorization

A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by this issue is the function dfrpsajaxdeletesavedsearch of the file functions/ajax.php of the component AJAX Handlers. The manipulation results in missing authorization. The attack may be launched...

EUVD-2026-109599

A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by this issue is the function dfrpsajaxdeletesavedsearch of the file functions/ajax.php of the component AJAX Handlers. The manipulation results in missing authorization. The attack may be launched...

CVE-2026-116107

The Datafeedr Product Sets Plugin for WordPress, affecting versions up to 1.3.24 , contains a vulnerability in the AJAX Handlers component. Specifically, the function dfrps_ajax_delete_saved_search within the functions/ajax.php file is susceptible to missing authorization . This flaw allows for r...

CVE-2026-116107 Datafeedr Product Sets Plugin AJAX Handlers ajax.php dfrps_ajax_delete_saved_search authorization

A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by this issue is the function dfrpsajaxdeletesavedsearch of the file functions/ajax.php of the component AJAX Handlers. The manipulation results in missing authorization. The attack may be launched...