CVE-2026-109926 Productive Commerce < 1.1.49 - Subscriber+ Arbitrary Plugin Activation

The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbitrary Productive Commerce WordPress plugin befo...

CVE-2026-109147 WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter

The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators...

EUVD-2026-107067

The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbitrary Productive Commerce WordPress plugin befo...

CVE-2026-109926 Productive Commerce < 1.1.49 - Subscriber+ Arbitrary Plugin Activation

The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbitrary Productive Commerce WordPress plugin befo...

CVE-2026-109926

The Productive Commerce WordPress plugin, in versions prior to 1.1.49 , is vulnerable to unauthorized plugin activation due to a missing capability check in one of its AJAX actions. Because the plugin exposes the required nonce on every admin-area page, any authenticated user , such as a subscrib...

WordPress Productive Commerce plugin < 1.1.49 - Subscriber+ Arbitrary Plugin Activation vulnerability

Subscriber+ Arbitrary Plugin Activation vulnerability discovered by Daniel Dhaniswara in WordPress Plugin Productive Commerce versions 1.1.49...

CVE-2026-109147 WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter

The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators...

CVE-2026-107788 SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide...

CVE-2026-107788

The SmartyParcel WordPress plugin (also known as WC Ukr Shipping ) before version 1.23.4 is vulnerable to a missing authorization check. This flaw allows any authenticated user , such as a subscriber, to delete shipping label and tracking records for arbitrary orders across the entire store. No s...

CVE-2026-107789

The SmartyParcel WordPress plugin versions before 1.23.4 is vulnerable to an unauthenticated shipping label disclosure due to a lack of authorization checks. An attacker can obtain shipping labels for arbitrary orders, which contain sensitive information such as customer names, addresses, and pho...

WordPress SmartyParcel plugin < 1.23.4 - Unauthenticated Shipping Label Disclosure vulnerability

Unauthenticated Shipping Label Disclosure vulnerability discovered by Ryan Fabella in WordPress Plugin WC Ukraine Shipping versions 1.23.4...

CVE-2026-107788 SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide...

CVE-2026-107789 SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers...

CVE-2026-107789 SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers...

CVE-2026-106932 Moloni < 5.0.14 - Subscriber+ Arbitrary Order Invoice Generation via genInvoice

The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authenticated user such as a Subscriber to generate fisca...

EUVD-2026-107056

The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses...

CVE-2026-106932

The Moloni WordPress plugin versions prior to 5.0.14 is vulnerable to an authorization bypass. The plugin fails to perform capability or nonce checks on several authenticated AJAX actions, relying instead on the presence of a stored connection to an external invoicing provider. This allows any au...

CVE-2026-106932 Moloni < 5.0.14 - Subscriber+ Arbitrary Order Invoice Generation via genInvoice

The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authenticated user such as a Subscriber to generate fisca...

CVE-2026-105998 Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization

The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features...

CVE-2026-105992 Ettrick Escape Room Booking < 1.3.1 - Unauthenticated Payment Confirmation Bypass

The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the payment provider before marking it paid and confirmed, allowing unauthenticated attackers to mark bookings as paid without paying...