EUVD-2025-210616

The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...

CVE-2026-16981

The CVE-2026-16981 entry concerns the DHL Shipping Germany for WooCommerce WordPress plugin (pre-4.0.1). The vulnerability is an unauthenticated IDOR on a shipping-label download endpoint, where no authorization checks (capability, nonce, login, or ownership) are performed, allowing an unauthenti...

EUVD-2026-53111

The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed to post unfiltered HTML, allowing users with the Author role to store JavaScript that is served unescaped at a public URL and executes for...

CVE-2026-16613 GDPR Cookie Compliance < 5.1.0 - Cookie Deletion and Forced Logout via CSRF

The GDPR Cookie Compliance WordPress plugin before 5.1.0 expires the visitor's cookies from an action that is reachable without authentication and performs no request-origin check, allowing an attacker to log any user out and delete the site's cookies by luring them to a crafted link...

EUVD-2026-53109

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data...

CVE-2026-16746 MultiVendorX < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data...

EUVD-2026-53110

The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path before deletion, allowing unauthenticated users to delete arbitrary files on the server such as wp-config.php, which can lead to a full site takeover...

EUVD-2026-53112

The GeoDirectory WordPress plugin before 2.8.168 does not restrict a user-search handler to users allowed to list users, allowing any authenticated user with Contributor-level access or higher to retrieve the email addresses of all registered users, including administrators...

CVE-2026-16746

CVE-2026-16746 affects the WordPress plugin MultiVendorX prior to 5.0.11. The REST API endpoint fails to verify that the requested store belongs to the current user, enabling any vendor-level user to read other vendors’ commission and financial data. The description does not specify affected vers...

CVE-2026-16942

CVE-2026-16942 affects the WP Custom HTML Page WordPress plugin up to version 0.6.2. The vulnerability arises because HTML stored via a custom page handler is not sanitized and is not restricted to users allowed to post unfiltered HTML, enabling authors to store JavaScript that is served unescape...

CVE-2026-16942 WP Custom HTML Pages <= 0.6.2 - Author+ Stored XSS

The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed to post unfiltered HTML, allowing users with the Author role to store JavaScript that is served unescaped at a public URL and executes for...

CVE-2026-16736 User Registration & Membership < 5.2.6 - Unauthenticated Account Creation While Registration Disabled

The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's registration-disabled setting when processing registration-form submissions, allowing unauthenticated users to create new accounts even when the administrator has turned off open registration...

EUVD-2026-53107

The GDPR Cookie Compliance WordPress plugin before 5.1.0 expires the visitor's cookies from an action that is reachable without authentication and performs no request-origin check, allowing an attacker to log any user out and delete the site's cookies by luring them to a crafted link...

CVE-2026-16940 Custom Fields for WooCommerce < 1.5.1 - Unauthenticated Arbitrary File Deletion via Path Traversal

The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path before deletion, allowing unauthenticated users to delete arbitrary files on the server such as wp-config.php, which can lead to a full site takeover...

CVE-2026-16968

The CVE covers GeoDirectory for WordPress, specifically the plugin version prior to 2.8.168. The vulnerability arises because the user-search handler is not restricted to users authorized to list users, allowing any authenticated user with Contributor-level access or higher to retrieve the email ...

CVE-2026-16736

CVE-2026-16736 affects the WordPress plugin User Registration & Membership (versions prior to 5.2.6). The issue: registration submissions do not respect the site’s registration-disabled setting, enabling unauthenticated users to create accounts even when open registration is turned off. Impact is...

CVE-2026-16613

The CVE concerns the GDPR Cookie Compliance WordPress plugin (vulnerable before 5.1.0). The flaw allows a CSRF-style action reachable without authentication and without a proper request-origin check, enabling an attacker to force logout of any user and delete site cookies by luring a target to a ...

CVE-2026-16603 Content Protector (Passster) < 4.3.6 - Unauthenticated Category-Locked Content Disclosure via Core REST API

The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts through the core REST API...

CVE-2026-16573 Bit Form < 3.2.0 - Unauthenticated Stored XSS via SVG Signature Upload

The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when the file is viewed, leading to Stored Cross-Site Scripting...

EUVD-2026-53101

The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when the file is viewed, leading to Stored Cross-Site Scripting...