EUVD-2026-116713

The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on calendars configured to require online payment, allowing unauthenticated users to create confirmed bookings without paying...

EUVD-2026-116716

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before modifying or deleting stored video and meta records, allowing authenticated users with Contributor-level access and above to modify or delete arbitrary records belonging to other...

CVE-2026-108041

The SEOPress WordPress plugin before version 10.4 is vulnerable to Stored Cross-Site Scripting (XSS) . The issue stems from a failure to properly sanitise and escape certain analytics tracking settings before they are output as an inline script on every front-end page. This allows users with spec...

CVE-2026-106000 Booking Package < 1.7.34 - Unauthenticated Payment Bypass

The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on calendars configured to require online payment, allowing unauthenticated users to create confirmed bookings without paying...

Origin Validation Error

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Origin Validation Error via the expo plugin's public authorization-proxy endpoint, which signs a caller-supplied state value with the application secret...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via the expo plugin's public authorization-proxy endpoint, which signs a caller-supplied state value with the application secret without verifying that the server had previously issued that value. Because the sam...

Gravity SMTP WordPress Plugin - Sensitive Information Exposure

Gravity SMTP WordPress plugin = 2.1.4 contains a sensitive information exposure caused by an unrestricted REST API endpoint at /wp-json/gravitysmtp/v1/tests/mock-data, letting unauthenticated attackers retrieve detailed system configuration data, exploit requires no authentication. id:...

WP Fastest Cache 1.2.2 - SQL Injection

The WP Fastest Cache WordPress plugin before 1.2.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users. id: CVE-2023-6063 info: name: WP Fastest Cache 1.2.2 - SQL Injection author: DhiyaneshDK...

WordPress POST SMTP Mailer <= 2.8.7 - Authorization Bypass

The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.8.7. i...

WordPress File Upload <= 4.24.11 - Arbitrary File Read

The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfufiledownloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory. Successful exploitatio...

WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the currentpageid parameter found in the /includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain...

WordPress TI WooCommerce Wishlist <1.40.1 - SQL Injection

WordPress TI WooCommerce Wishlist plugin before 1.40.1 contains a SQL injection vulnerability. The plugin does not sanitize and escape the itemid parameter before using it in a SQL statement via the wishlist/removeproduct REST endpoint. id: CVE-2022-0412 info: name: WordPress TI WooCommerce...

CVE-2026-104799: rnlab Mobile builder: The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including,…

The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the wcfmmpprofilesettings REST handler exposed at POST /mobile-builder/v1/wcfm-profile-settings. This is due to a PHP loose-comparison logic flaw in the meta key allow-lis...

PT-2026-136971

Name of the Vulnerable Software and Affected Versions Sender plugin for WordPress versions prior to 2.11.3 MultiVendorX plugin for WordPress versions prior to 5.0.21 Description A missing authorization flaw allows any authenticated user, such as those with Subscriber roles, to access a sensitive...

CVE-2026-119745: Sender: Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated…

Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump by requesting the adminpostsenderdebugdownload action handled by downloadDebugFile without any capability, nonc...

PT-2026-136928

The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the wcfmmp profile settings REST handler exposed at POST /mobile-builder/v1/wcfm-profile-settings. This is due to a PHP loose-comparison logic flaw in the meta key...

PT-2026-137152

CESNET ipfixcol2 2.3.0 before 2.9.0 contains an integer overflow vulnerability in the Forwarder output plugin that allows unauthenticated IPFIX exporters to overflow a heap buffer by wrapping uint16 t message length counters. Attackers can send near-65535-byte data sets and large templates to a...

gradle-static-analysis-plugin

DEPRECATED Gradle static analysis plugin ⚠️ A fork of this project is maintained at https://github.com/GradleUp/static-analysis-plugin/ Please migrate by using com.gradleup.static-analysis plugin id instead. A Gradle plugin to easily apply the same setup of static analysis tools across different...

HoneyPy

HoneyPy 🍯 A low interaction honeypot with the capability to be more of a medium interaction honeypot. Project status: No longer in active development. Repository will remain for anyone wanting to use or contribute to HoneyPy. I recommend using the honeydb-agent instead:...

CVE-2026-121509

A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function getrequiredpostdata of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument postid/postslug results in information disclosure. The attack may be...