CVE-2026-110135 OTP Login & Register Woocommerce < 2.7.3 - Unauthenticated Account Takeover via OTP Brute Force

The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against a value the client itself supplies and can change freely, allowing an unauthenticated attacker to bypass the limit and...

EUVD-2026-102691

The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as a subscriber to read every customer's booking records, including their personal data...

CVE-2026-110014 Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and Status

The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers to create bookings attributed to arbitrary users, overwrite those users'...

CVE-2026-110013 Salon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-Token

The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure random source, instead deriving them from a value hardcoded in the Salon Booking System WordPress plugin before 10.31.9 and the second at which a token was issued. An attacker ab...

EUVD-2026-102690

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does not perform a capability check or validate a nonce on its migration actions, allowing any authenticated user, such as a subscriber, to trigger a one-way migration that creates published records and permanently delete...

EUVD-2026-102686

The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gallery on demand, allowing unauthenticated users to enumerate and disclose the titles, descriptions and direct file URLs of media attached to unpublished, private or trashed...

EUVD-2026-102687

The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks on sites that also run the WCFM Delivery add-on...

CVE-2026-105974 Visual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget

The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any authenticated user Subscriber and above to read other users' submitted contact information, including names, email...

CVE-2026-92427 Coinsnap Bitcoin Crowdfunding <= 1.2.0 - Unauthenticated Payment Record Forgery via Webhook Secret Disclosure

The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing it to unauthenticated users and rendering the webhook's signature check ineffective. This allows unauthenticated attackers to forge...

CVE-2026-91830 Subscribe to Comments < 2.3.3 - Unauthenticated Subscription Management Key Disclosure via Forged Comment Cookie

The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter, allowing unauthenticated attackers to disclose a subscriber's management key and silently alter that subscriber's subscriptions...

CVE-2026-91830

The Subscribe to Comments WordPress plugin, in versions prior to 2.3.3 , is vulnerable to an unauthenticated Subscription Management Key Disclosure . The root cause is that the plugin fails to sign or validate a cookie used to identify a commenter. This allows an unauthenticated attacker to discl...

CVE-2026-91833 WX Subscribe <= 1.2.1 - Unauthenticated SQLi via 'attach' Parameter

The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks on installs where the payment key has not been configured...

CVE-2026-91833

The WX Subscribe 微信支付付费订阅 WordPress plugin (versions up to and including 1.2.1 ) is vulnerable to an unauthenticated SQL injection attack. The flaw occurs because the plugin fails to properly sanitize and escape a parameter before utilizing it in a SQL statement. This vulnerability specifically a...

EUVD-2026-102669

The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.11.1 This is due to the software allowing users to execute an action that does not properly validate a value before running...

CVE-2026-109219

The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the mbwfileupload function. This is due to missing file extension validation on the attacker-supplied imagepath parameter, whose basename-derived file name bypasses the extension allowlist applied only...

EUVD-2026-102640

The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in versions up to, and including, 1.31.4 This is due to insufficient escaping on the user supplied filter 'value' before it is appended to a SQL que...

CVE-2026-111106 Mail Mint <= 1.31.4 - Authenticated (Custom+) SQL Injection via 'filters' Parameter

The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in versions up to, and including, 1.31.4 This is due to insufficient escaping on the user supplied filter 'value' before it is appended to a SQL que...

EUVD-2026-102636

The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4 via the mbwfileupload function. This is due to missing file extension validation on the attacker-supplied imagepath parameter, whose basename-derived file name bypasses the...

EUVD-2026-102616

The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents o...

PT-2026-115574

Name of the Vulnerable Software and Affected Versions GeoDirectory versions prior to 2.8.192 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access or higher to perform Stored Cross-Site Scripting. By utilizing the post content...