EUVD-2026-53103

The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an unauthenticated REST endpoint, allowing unauthenticated users to disclose the content of non-public draft, private, and pending posts on sites that have a captcha provider...

EUVD-2026-53104

The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts through the core REST API...

CVE-2026-16573

The CVE-2026-16573 vulnerability affects the Bit Form WordPress plugin prior to version 3.2.0. An unauthenticated attacker can upload a crafted SVG signature image that contains JavaScript, which is not sanitized before storage and executes when viewed, enabling Stored XSS. This is tied to the pl...

CVE-2026-16603

The Passster WordPress plugin is affected by CVE-2026-16603: versions prior to 4.3.6 do not enforce category-based content protection on the WordPress REST API, allowing unauthenticated users to read full content, title, and excerpt of category-locked posts via the core REST API. This is an unaut...

CVE-2026-16602

CVE-2026-16602 (Passster, WordPress plugin) : The Passster plugin is affected for versions before 4.3.6. An unauthenticated REST endpoint does not perform a post-status check, allowing unauthenticated users to disclose content of non-public posts (draft, private, pending) on sites that have a cap...

EUVD-2026-53105

The Passster WordPress plugin before 4.3.6 outputs password-protected block content in the public page response before verifying the password, allowing unauthenticated users to recover the protected content without knowing the password...

CVE-2026-16602 Content Protector (Passster) < 4.3.6 - Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint

The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an unauthenticated REST endpoint, allowing unauthenticated users to disclose the content of non-public draft, private, and pending posts on sites that have a captcha provider...

CVE-2026-16583 Orbit Fox by ThemeIsle < 3.0.8 - Author+ Stored XSS via SVG Upload

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.8 does not sanitize uploaded SVG files when its SVG upload feature is enabled, allowing authenticated users with the upload capability Author and above by default, without the...

EUVD-2026-53106

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to the requesting vendor, allowing an authenticated vendor Store Owner and above to view, take over, permanently delete, or modify any other vendor's store on the marketplace...

EUVD-2026-53102

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.8 does not sanitize uploaded SVG files when its SVG upload feature is enabled, allowing authenticated users with the upload capability Author and above by default, without the...

CVE-2026-16604 Content Protector (Passster) < 4.3.6 - Unauthenticated Protected Content Disclosure via Content-Lock Block data-content Attribute

The Passster WordPress plugin before 4.3.6 outputs password-protected block content in the public page response before verifying the password, allowing unauthenticated users to recover the protected content without knowing the password...

CVE-2026-16583

CVE-2026-16583 affects the Orbit Fox by ThemeIsle WordPress plugin prior to 3.0.8. The SVG upload feature does not sanitize uploaded SVG files, enabling stored XSS: authenticated users with upload capability (Author and above by default, without unfiltered_html) can upload SVGs containing JavaScr...

CVE-2026-16604

CVE-2026-16604 affects the Passster WordPress plugin prior to 4.3.6. The vulnerability arises when a password-protected block’s content is inadvertently included in the public page response before the password is verified, allowing unauthenticated users to recover the protected content without kn...

WordPress Passster plugin < 4.3.6 - Unauthenticated Protected Content Disclosure vulnerability

Unauthenticated Protected Content Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Passster versions 4.3.6...

CVE-2026-16561 Sunshine Photo Cart < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure

The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries...

EUVD-2026-53100

The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries...

EUVD-2026-53034

The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to SQL Injection via the 's' search parameter on the Pretty Links listing page in all versions up to, and including, 3.6.20. This is due to insufficient escapin...

CVE-2026-5062 PrettyLinks <= 3.6.20 - Authenticated (Administrator+) SQL Injection via 's' Parameter

The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to SQL Injection via the 's' search parameter on the Pretty Links listing page in all versions up to, and including, 3.6.20. This is due to insufficient escapin...

CVE-2026-5062

The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to SQL Injection via the 's' search parameter on the Pretty Links listing page in all versions up to, and including, 3.6.20. This is due to insufficient escapin...

CVE-2026-5062

CVE-2026-5062 affects PrettyLinks (WordPress plugin) versions up to and including 3.6.20. The vulnerability is an SQL injection via the 's' (search) parameter on the Pretty Links listing page, caused by insufficient escaping and lack of proper prepared statements in search_links_table(). It requi...