CVE-2026-89288

The Fast Courier WordPress plugin (versions 5.0.0-5.2.3 ) is vulnerable to SQL injection because it fails to sanitize and escape a value used in a SQL query on an unauthenticated REST route . Specifically, the vulnerability is triggered via the 'wp_order_id' parameter. An unauthenticated attacker...

CVE-2026-89288 Fast Courier 5.0.0 - 5.2.3 - Unauthenticated SQLi via 'wp_order_id' Parameter

The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...

CVE-2026-90989

The Tainacan WordPress plugin before version 1.4.0 contains a vulnerability where its reports REST endpoints lack proper access controls. Specifically, the plugin fails to restrict these endpoints to users with management capabilities, which allows any authenticated subscriber to disclose the ema...

EUVD-2026-100861

The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subscriber to read the email addresses of the repository's staff...

EUVD-2026-100860

The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...

WordPress Tainacan plugin < 1.4.0 - Subscriber+ Repository Staff Email Address Disclosure vulnerability

Subscriber+ Repository Staff Email Address Disclosure vulnerability discovered by Artus KG in WordPress Plugin Tainacan versions 1.4.0...

CVE-2026-86799

The Forms WordPress plugin (versions before 3.0.2 ) is vulnerable to unauthenticated stored XSS . The root cause is a failure to sanitise submitted form values on storage and a failure to escape those values before they are outputted on the form submissions screen within the administration dashbo...

WordPress Pricing Table plugin 1.0.7-2.1.4 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Philipp Doblhofer in WordPress Plugin Pricing Table block – Display product prices as a table. versions 1.0.7-2.1.4...

CVE-2026-108064 WP Encryption < 7.8.8.2 - Unauthenticated Certificate Private Key and ACME Order Replacement via wple_auto_handler

The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routine, allowing unauthenticated users to make the WP Encryption WordPress plugin before 7.8.8.2 overwrite the site's certificate...

CVE-2026-108064

The WP Encryption WordPress plugin versions before 7.8.8.2 contains a vulnerability in its SSL certificate-provisioning routine. Due to a lack of capability or nonce checks on the wple_auto_handler , unauthenticated users can overwrite the site's certificate private key and replace pending Let's ...

CVE-2026-85000 EmbedPress < 4.6.8 - Unauthenticated YouTube API Quota Consumption and Database Bloating

The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credential-bearing request to a third-party API and stores attacker-controlled cache entries, allowing unauthenticated attackers to consume the si...

CVE-2026-85000 EmbedPress < 4.6.8 - Unauthenticated YouTube API Quota Consumption and Database Bloating

The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credential-bearing request to a third-party API and stores attacker-controlled cache entries, allowing unauthenticated attackers to consume the si...

CVE-2026-107319

The GamiPress WordPress plugin before version 8.0.6 is vulnerable to an activity log disclosure due to a missing capability check and ownership verification on an authenticated AJAX action . This flaw allows any authenticated user, such as a Subscriber , to read arbitrary entries from the activit...

CVE-2026-107160

The LTL Freight Quotes – Old Dominion Edition WordPress plugin (versions before 4.2.19 ) is vulnerable to unauthenticated stored HTML injection . The flaw exists because the plugin fails to perform proper authorization checks or input sanitization before storing specific request values. This allo...

CVE-2026-107320

The GamiPress WordPress plugin, in versions 7.9.5 through 8.0.5 , contains a vulnerability where it fails to properly authorize access to private activity log entries . This flaw allows unauthenticated users to retrieve the private activity logs of all users on the site. This issue represents an ...

EUVD-2026-100891

The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing unauthenticated users to retrieve the private activity logs of all users. This is an incomplete fix of CVE-2026-13450...

CVE-2026-107178 Image Photo Gallery Final Tiles Grid < 3.6.16 - Contributor+ Stored XSS via 'lightboxOptions' Parameter

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes ...

CVE-2026-107320 GamiPress 7.9.5 - 8.0.5 - Unauthenticated Private Activity Log Disclosure

The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing unauthenticated users to retrieve the private activity logs of all users. This is an incomplete fix of CVE-2026-13450...

CVE-2026-106099

The WP Data Access WordPress plugin (versions before 5.5.84 ) is vulnerable to unauthenticated sensitive data disclosure . The plugin fails to restrict its database table export action to authorized users, instead relying on a token that is publicly printed on the pages where tables are displayed...

CVE-2026-106469

The Gutenverse Form WordPress plugin versions before 3.0.11 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is a failure to sanitize SVG icon markup stored in form blocks before it is decoded and inserted into the browser page. This allows authenticated users with Contri...