EUVD-2026-85047

The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, and that construction happens on every wp-admin request for any logged-in user. Any...

WordPress Post Grid Gutenberg Blocks plugin < 5.0.41 - Unauthenticated Custom Field Key Disclosure vulnerability

Unauthenticated Custom Field Key Disclosure vulnerability discovered by Pedro Pinho in WordPress Plugin PostX versions 5.0.41...

WordPress Forminator Forms plugin 1.38.1-1.57.2.0 - Subscriber+ Form Stripe Field Migration vulnerability

Subscriber+ Form Stripe Field Migration vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Forminator versions 1.38.1-1.57.2.0...

CVE-2026-85006 Happy Addons for Elementor < 3.50.0 - Contributor+ Stored XSS via Creative Button Widget

The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute, allowing users with Contributor-level access and above to inject event-handler attributes that execute JavaScript in the browser o...

EUVD-2026-85039

The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review...

WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin < 8.9.5 - Subscriber+ Cross-User Favorites Read and Write vulnerability

Subscriber+ Cross-User Favorites Read and Write vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Directorist versions 8.9.5...

CVE-2026-84098 Directorist 3.1.0 - 8.9.4 - Subscriber+ Arbitrary Listing Deletion via remove_listing

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary listings, including ones belonging...

CVE-2026-84046 Directorist < 8.9.5 - Subscriber+ SSRF via Avatar URL

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side, allowing users with the subscriber role and above to make the server issue requests to internal addresses...

CVE-2026-84027 Directorist 8.9.1 - 8.9.4 - Subscriber+ Paid Order and Payment Record Forgery via REST Orders Endpoint

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its REST API, allowing users with the subscriber role and above to create paid order and payment records with arbitrary amounts and...

CVE-2026-84046

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions prior to 8.9.5 is vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is a failure to validate user-supplied URLs before fetching them server-side, specifically via the Avatar URL f...

CVE-2026-84026 Directorist 8.1 - 8.9.4 - Unauthenticated Sensitive Data Disclosure via REST Users Endpoint

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not restrict access to a REST endpoint that returns user records, allowing unauthenticated attackers to read registered users' private contact details...

CVE-2026-84098 Directorist 3.1.0 - 8.9.4 - Subscriber+ Arbitrary Listing Deletion via remove_listing

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary listings, including ones belonging...

CVE-2026-84046 Directorist < 8.9.5 - Subscriber+ SSRF via Avatar URL

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side, allowing users with the subscriber role and above to make the server issue requests to internal addresses...

CVE-2026-84027 Directorist 8.9.1 - 8.9.4 - Subscriber+ Paid Order and Payment Record Forgery via REST Orders Endpoint

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its REST API, allowing users with the subscriber role and above to create paid order and payment records with arbitrary amounts and...

WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin < 8.9.5 - Subscriber+ SSRF vulnerability

Subscriber+ SSRF vulnerability discovered by Bhaveshkumar Parmar in WordPress Plugin Directorist versions 8.9.5...

CVE-2026-84026

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions 8.1 through 8.9.4 contains a vulnerability that fails to restrict access to a REST endpoint used for returning user records. This flaw allows unauthenticated attackers to access and read private co...

CVE-2026-84027

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions 8.9.1-8.9.4 is vulnerable to a paid order and payment record forgery vulnerability. The root cause is a failure to check user capabilities when creating orders via the plugin's REST API . This allo...

CVE-2026-81338 MasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding...

CVE-2026-81339 MasterStudy LMS < 3.7.50 - Subscriber+ Quiz Attempt Grade Disclosure via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform a per-object ownership check when returning a quiz attempt result, allowing any authenticated user with a minimal subscriber role to read other students' quiz grades, pass/fail status and attempt timestamps by...

CVE-2026-77765 Better Payment < 2.3.4 - Unauthenticated Payment Amount Manipulation

The Better Payment WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price before building the gateway charge, allowing unauthenticated users to pay an arbitrary reduced amount for a fixed-price item...