CVE-2026-87959 WPBot 8.7.2 - 8.7.5 - Subscriber+ Claude AI Settings Update

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI...

EUVD-2026-80211

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category...

CVE-2026-89328

The FluentBoards WordPress plugin, in versions prior to 2.0.15 , contains an improper access control vulnerability. The software fails to properly verify if a user possesses board-manager privileges before executing various board-management operations, incorrectly relying only on board membership...

CVE-2026-88910 KBoard < 6.7 - Unauthenticated Board Media Deletion via IDOR

The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board media, allowing unauthenticated attackers to permanently delete its uploaded media files and their database records by iterating identifiers...

CVE-2026-87959

The WPBot WordPress plugin (versions 8.7.2-8.7.5 ) is vulnerable to improper access control due to a missing capability check on an AJAX action . This flaw allows users with subscriber-level access to overwrite the plugin's Claude AI provider settings , which includes the API key used for outgoin...

EUVD-2026-80215

The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges before performing several board-management operations, checking only board membership. This allows any member of a board to carry out manager-only actions on it, including adding or...

CVE-2026-89327 FluentBoards < 2.0.15 - Board Member+ Comment Author Spoofing via 'comment_by' Parameter

The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is the user the comment is attributed to, allowing any board member to post comments that appear to be authored by another user, including administrators...

CVE-2026-87907 Rox Appointment Booking < 1.2.8 - Unauthenticated Internal Notes Disclosure via Service and Category REST Routes

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category...

CVE-2026-89327

The FluentBoards WordPress plugin (versions before 2.0.15 ) is vulnerable to a comment author spoofing flaw. The application fails to verify that a board member submitting a comment is the same user to whom the comment is attributed. This allows any authenticated board member to post comments app...

CVE-2026-87896

The Rox Appointment Booking WordPress plugin, in versions prior to 1.2.8 , is vulnerable to unauthenticated staff PII disclosure. The root cause is a lack of authorization checks on the endpoint responsible for returning booking agent (staff) records. This allows unauthenticated attackers to acce...

CVE-2026-87896 Rox Appointment Booking < 1.2.8 - Unauthenticated Staff PII Disclosure via Agent REST Route

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent staff records, allowing unauthenticated attackers to read staff email addresses, phone numbers, private internal notes and the linked WordPress account nam...

CVE-2026-88910

The kboard WordPress plugin (versions before 6.7 ) is vulnerable to an unauthenticated board media deletion due to an IDOR (Insecure Direct Object Reference) flaw. The plugin fails to verify ownership or context before processing media deletion requests, allowing an attacker to permanently delete...

EUVD-2026-80212

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI...

EUVD-2026-80214

The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is the user the comment is attributed to, allowing any board member to post comments that appear to be authored by another user, including administrators...

EUVD-2026-80210

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent staff records, allowing unauthenticated attackers to read staff email addresses, phone numbers, private internal notes and the linked WordPress account nam...

CVE-2026-87907

The Rox Appointment Booking WordPress plugin, in versions prior to 1.2.8 , is vulnerable to an unauthenticated internal notes disclosure . The root cause is a lack of authorization checks on the endpoints responsible for returning booking service and category records. This allows unauthenticated ...

EUVD-2026-80205

The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such...

CVE-2026-86823 Newsletter < 9.3.7 - Unauthenticated Open Redirect and Subscriber Token Disclosure via ncu Parameter

The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthenticated attackers to redirect users to arbitrary external sites and to disclose a subscriber token that grants access to that subscriber...

CVE-2026-86784 Visualizer < 4.0.8 - Contributor+ Stored XSS via JSON Data Source

The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such...

CVE-2026-86823

The Newsletter WordPress plugin (versions before 9.3.7 ) contains a vulnerability where it fails to validate the destination of a redirect following a public subscription action. This allows unauthenticated attackers to perform an open redirect to arbitrary external sites and disclose a subscribe...