CVE-2026-12720 Kirki < 6.0.13 - Unauthenticated PHP Object Injection

The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present ...

CVE-2026-13392 ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPress plugin before 3.10.01 subsequently...

EUVD-2026-51431

The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present ...

CVE-2026-15381 WP Go Maps < 10.1.04 - Unauthenticated SQL Injection via Markers REST filter

The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

EUVD-2026-51427

The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks...

CVE-2026-15209 JS Help Desk – AI-Powered Support & Ticketing System < 3.1.5 - Subscriber+ Cross-User Support Ticket Disclosure via IDOR

The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body...

CVE-2026-14931

The CVE-2026-14931 entry affects the JS Help Desk WordPress plugin prior to version 3.1.4. It enables a support-agent capability to the Contributor role at activation and omits a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all r...

EUVD-2026-51425

The Geeky Bot WordPress plugin before 1.2.8 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to retrieve chat-history session metadata including WordPress usernames, user IDs, and timestamps...

CVE-2026-15209

The CVE-2026-15209 entry concerns the JS Help Desk WordPress plugin (before version 3.1.5). The affected component handles tickets without verifying that the requesting user owns the ticket being loaded, enabling a low-privileged authenticated user to supply another user’s ticket ID and read that...

EUVD-2026-51426

The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body...

CVE-2026-15381

The WP Go Maps WordPress plugin prior to version 10.1.04 is vulnerable to an unauthenticated SQL injection via the Markers REST filter due to improper sanitisation/escaping of a parameter before it is used in a SQL query. Impact is low according to the CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L...

CVE-2026-15048

CVE-2026-15048 affects the Geeky Bot WordPress plugin prior to version 1.2.8. The flaw is an missing authorization check on one AJAX action, allowing unauthenticated users to access chat-history session metadata (WordPress usernames, user IDs, and timestamps). The connected sources confirm the af...

CVE-2026-14931 JS Help Desk < 3.1.4 - Contributor+ User Email Disclosure

The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users...

EUVD-2026-51424

The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users...

EUVD-2026-51428

The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-15048 GeekyBot < 1.2.8 - Unauthenticated Sensitive Information Exposure via Chat History

The Geeky Bot WordPress plugin before 1.2.8 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to retrieve chat-history session metadata including WordPress usernames, user IDs, and timestamps...

CVE-2026-14929 JS Help Desk < 3.1.4 - Subscriber+ Ticket Reply Modification via IDOR

The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user Subscriber and above to overwrite the content of any support-ticket reply on the site...

CVE-2026-14927 FluentCart < 1.5.3 - Unauthenticated Order PII Disclosure via Print Routes

The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order documents keyed on a sequential numeric identifier, allowing unauthenticated visitors to enumerate and disclose customer personal data names,...

CVE-2026-14929

The CVE-2026-14929 entry concerns the JS Help Desk WordPress plugin, affected versions before 3.1.4. The vulnerability is an IDOR where the plugin does not verify ownership of the targeted reply before updating it, allowing any authenticated user (Subscriber or higher) to overwrite the content of...

CVE-2026-14927

The CVE concerns FluentCart (WordPress plugin) versions prior to 1.5.3. The issue is lack of authorization/ownership checks when rendering customer order documents identified by sequential numeric IDs, enabling unauthenticated visitors to enumerate and disclose customer PII (names, emails, billin...