CVE-2026-13604

Pixelavo WordPress plugin before 1.5.4 registers an unauthenticated AJAX action gated only by a publicly emitted nonce, forwarding client-supplied event data to the Facebook Conversions API using the administrator’s stored access token. This enables an unauthenticated visitor to inject arbitrary ...

CVE-2026-13604

The Pixelavo WordPress plugin before 1.5.4 registers an unauthenticated AJAX action, gated only by a nonce that it emits publicly on every front-end page, that forwards client-supplied event data to the configured Facebook Conversions API using the administrator's stored access token. This allows...

CVE-2026-13729

The CVE concerns the Podlove Podcast Publisher WordPress plugin prior to version 4.5.3. The vulnerability is a CSRF (forged request) flaw caused by missing nonce validation on certain administrative create and delete actions, enabling an attacker to create rogue records or delete legitimate ones ...

EUVD-2026-51700

The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-13725

The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against...

EUVD-2026-51704

The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning post content, allowing users with the Contributor role or higher to read the content of arbitrary posts, including other users' private, pending, and draft posts...

WordPress Spectra Legacy plugin < 2.20.0 - Contributor+ Stored CSS Injection vulnerability

Contributor+ Stored CSS Injection vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Spectra versions 2.20.0...

EUVD-2026-51699

The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds, allowing any authenticated user, including Subscribers, to trigger refunds against captured orders...

CVE-2026-13157 Theme Demo Import <= 1.1.3 - Admin+ Arbitrary File Upload

The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import the WordPress file-type test is disabled, allowing high-privilege users Administrator by default, including non-super-admin site administrators on multisite to upload executable...

CVE-2026-12696

The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor wh...

CVE-2026-10827

The CVE-2026-10827 entry concerns Spectra Legacy (WordPress) plugin prior to 2.20.0. The vulnerability is a CSS-injection flaw: the plugin fails to validate/escape several block-style attributes used to build front-end CSS. With Contributor+ privileges, an attacker can inject arbitrary CSS that i...

EUVD-2026-51713

The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import the WordPress file-type test is disabled, allowing high-privilege users Administrator by default, including non-super-admin site administrators on multisite to upload executable...

CVE-2026-13329

The CVE-2026-13329 entry concerns the Buckaroo Woocommerce Payments Plugin for WordPress, affecting versions before 4.9.0. The vulnerability arises because an AJAX action that processes payment capture refunds does not perform any capability checks or nonce validation, allowing any authenticated ...

EUVD-2026-51698

The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor wh...

EUVD-2026-51696

The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. Th...

CVE-2026-13157

The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import the WordPress file-type test is disabled, allowing high-privilege users Administrator by default, including non-super-admin site administrators on multisite to upload executable...

CVE-2026-13329 WC Buckaroo BPE Gateway < 4.9.0 - Subscriber+ Unauthorized Order Refund

The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds, allowing any authenticated user, including Subscribers, to trigger refunds against captured orders...

CVE-2026-10827

The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. Th...

EUVD-2026-51697

The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token. A durable...

CVE-2026-11882 Builderall for WordPress < 3.0.2 - Unauthenticated OAuth Access Token Poisoning via Public REST Routes

The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token. A durable...