CVE-2026-19256

The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own brute-force protection, allowing...

CVE-2026-85347

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before outputting it in a page, which could allow users with the Contributor role and above to inject arbitrary web scripts that execute when a higher-privileged user views the...

CVE-2026-85570

The Tutor LMS WordPress plugin before 4.2.0 does not prevent the correct answers to quiz questions from being included in the page it serves to the student taking the quiz, and does so regardless of the setting intended to control whether answers are revealed, allowing any enrolled student to...

CVE-2026-107773

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order information and to add or delete order notes for ...

CVE-2026-109150 WP PageNavi Style <= 1.4 - Stored XSS via CSRF

The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of its settings, and has no CSRF check when they are saved, which could allow attackers to make a logged-in administrator store arbitrary JavaScript via a CSRF attack that is then executed in the browser of...

CVE-2026-109150

The WP PageNavi Style WordPress plugin (versions through 1.4 ) contains a Stored XSS vulnerability caused by a lack of input sanitization, escaping, and CSRF checks when saving settings. An attacker could trick a logged-in administrator into storing arbitrary JavaScript via a CSRF attack, which w...

EUVD-2026-117352

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order information and to add or delete order notes for ...

EUVD-2026-117349

The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database...

CVE-2026-100144 IVPAY payments <= 1.0.8 - Unauthenticated SQLi via 'payment_id' Parameter

The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database...

CVE-2026-105971

The Car Dealer (Dealership) and Vehicle sales WordPress plugin, in versions through 4.73 , is vulnerable to an unauthenticated content disclosure flaw. The cardealer_single_car_ajax action fails to restrict access to published content only, allowing an unauthenticated attacker to read the title, ...

CVE-2026-105971 Car Dealer <= 4.73 - Unauthenticated Private/Draft/Pending Post Content Disclosure via cardealer_single_car_ajax

The Car Dealer Dealership and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated single-listing AJAX action to published content, allowing an unauthenticated attacker to read the title, content and metadata of any private, draft, pending, future or trashed post by...

CVE-2026-100144

The IVPAY payments WordPress plugin, affecting versions through 1.0.8 , is vulnerable to an unauthenticated SQL injection . The root cause is the lack of input sanitization on a value from the payment callback (specifically via the 'payment_id' parameter) before it is used in a SQL statement. Fur...

CVE-2026-90966 Essential Real Estate < 5.3.5 - Customer+ Arbitrary Paid Package Activation and Forged Paid Invoice via ere_free_package_ajax

The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX actions, that a listing package selected for free activation is genuinely free or that the requesting user is entitled to it, allowing a self-registered customer to activate a paid package without payment...

CVE-2025-15701 Easy Social Icons < 4.0.3 - Admin+ Stored XSS via Icon Color Settings

The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is...

EUVD-2026-117346

The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX actions, that a listing package selected for free activation is genuinely free or that the requesting user is entitled to it, allowing a self-registered customer to activate a paid package without payment...

CVE-2026-90966

The Essential Real Estate WordPress plugin versions before 5.3.5 is vulnerable to an authorization bypass. In one of its AJAX actions , the plugin fails to verify if a listing package selected for free activation is genuinely free or if the requesting user is entitled to it. This allows a self-re...

EUVD-2026-117343

The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check in one of its AJAX actions, allowing unauthenticated users to read the full contents of property listings that have not been published, together with the private name, email...

CVE-2026-90964 Essential Real Estate < 5.3.5 - Unauthenticated Arbitrary Email Sending

The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing unauthenticated users to send emails to arbitrary addresses with an attacker-controlled sender header and message body through the site...

CVE-2026-90963

The Essential Real Estate WordPress plugin versions prior to 5.3.5 is vulnerable to an information disclosure flaw. The root cause is a lack of authorization or publication-status checks within the property_print_ajax AJAX action. This allows unauthenticated users to access and read the full cont...

CVE-2026-90964

The Essential Real Estate WordPress plugin versions prior to 5.3.5 contains a vulnerability that fails to restrict the recipient of one of its contact email actions. This allows unauthenticated users to send emails to arbitrary addresses using an attacker-controlled sender header and message body...