CVE-2026-82182 WPvivid Backup & Migration < 0.9.133 - Admin+ SQLi via Upload Cleaner Isolation

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not sanitise a user supplied list of identifiers before using it in a SQL query, allowing administrators to perform SQL injection attacks...

CVE-2026-81807 Simple Ajax Chat < 20260827 - Unauthenticated Stored XSS via Chat Message Linkification

The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML attributes into the page and run scripts in the browser of anyone viewing the chat, including administrators...

CVE-2026-81737

The FAQ Builder AYS WordPress plugin (versions 1.6.3 through 1.8.4 ) contains an unauthenticated Stored XSS in the ays_get_user_information function. Content submitted by unauthenticated visitors is stored and later rendered on an admin area page, but the escaping applied is undone by a subsequen...

EUVD-2026-69860

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not sanitise a user supplied list of identifiers before using it in a SQL query, allowing administrators to perform SQL injection attacks...

EUVD-2026-69857

The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them...

EUVD-2026-69859

The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML attributes into the page and run scripts in the browser of anyone viewing the chat, including administrators...

CVE-2026-82182

WPvivid — Backup, Migration & Staging WordPress plugin (versions before 0.9.133 ) contains an Admin+ SQL injection vulnerability in the Upload Cleaner Isolation feature. A user-supplied list of identifiers is not sanitised before being used in a SQL query, allowing authenticated administrator-lev...

CVE-2026-81583 Theme My Login 7.0 - 7.1.15 - Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation

The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them...

CVE-2026-81737 FAQ Builder AYS 1.6.3 - 1.8.4 - Unauthenticated Stored XSS via ays_get_user_information

The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by unauthenticated visitors before storing it and outputting it in an admin area page, and the escaping it does apply is undone by a subsequent decoding step, leading to Stored XSS which will execute i...

WordPress WPvivid — Backup, Migration & Staging plugin < 0.9.133 - Admin+ SQLi vulnerability

Admin+ SQLi vulnerability discovered by cyberkareem in WordPress Plugin WPvivid Backup and Migration versions 0.9.133...

CVE-2026-81428

CVE-2026-81428 affects the WC Vendors WordPress plugin in versions prior to 2.7.2.1 . The root cause is a missing ownership and object-type verification on user-supplied IDs during product variation saves, resulting in an Insecure Direct Object Reference (IDOR) flaw. An authenticated user with th...

EUVD-2026-69852

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, allowing unauthenticated attackers to disclose the course counts, points, certificates, quiz and assignment totals of any registered user...

CVE-2026-81432 JetStyleManager < 1.3.9 - Skin Deletion and Modification via CSRF

The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attackers to make a logged-in user with the editposts capability Contributor and above delete or modify custom widget skins via a crafted request, provided they can...

CVE-2026-81427

CVE-2026-81427 affects the WC Vendors WordPress plugin (WooCommerce marketplace) in versions before 2.7.2.1 . The root cause is a missing ownership verification on the front-end order shipment status change endpoint: any authenticated vendor can target another vendor's order, mark it as shipped ,...

CVE-2026-81198 MasterStudy LMS < 3.7.46 - Instructor+ Cross-Course Curriculum Deletion and Tampering via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sections and materials belonging to courses owned by other...

CVE-2026-81199

MasterStudy LMS WordPress Plugin versions before 3.7.46 contain an unauthenticated information disclosure vulnerability in the student/stats REST route . The endpoint fails to perform an authorization check before returning a student's learning statistics, allowing any unauthenticated attacker to...

EUVD-2026-69853

The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request...

EUVD-2026-69854

The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...

CVE-2026-81432

CVE-2026-81432 affects the JetStyleManager for Gutenberg WordPress plugin in versions before 1.3.9 . The root cause is a missing CSRF protection on certain AJAX actions, allowing an attacker to craft a request that, when executed by a logged-in user with the edit_posts capability (Contributor or ...

CVE-2026-81198

MasterStudy LMS WordPress plugin (versions before 3.7.46 ) contains an IDOR (Insecure Direct Object Reference) flaw: the plugin does not properly verify ownership of a curriculum object before acting on it. This allows authenticated users with the instructor role to delete or modify curriculum se...