295389 matches found
CVE-2026-111949 miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding
The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor...
EUVD-2026-107074
The Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perform authorisation checks when duplicating a legacy pricing table, allowing users with the contributor role and above to clone and publish any post or page on the site, including private and draft content belonging to...
CVE-2026-111947 Easy Pricing Tables < 4.1.3 - Contributor+ Arbitrary Post Clone and Publish via Legacy Table Duplication
The Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perform authorisation checks when duplicating a legacy pricing table, allowing users with the contributor role and above to clone and publish any post or page on the site, including private and draft content belonging to...
CVE-2026-108073
The SureCart WordPress plugin, in versions prior to 4.9.5 , is vulnerable to an unauthenticated private catalog data disclosure. The root cause is that the plugin fails to restrict related objects or strip private fields when an anonymous visitor reads a single upsell funnel via the REST API . Th...
CVE-2026-109147
The WP Booking System WordPress plugin (versions before 2.1.0.3 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to validate and escape the booking_id parameter before reflecting it back on an admin page. This vulnerability could be leveraged to target high-...
CVE-2026-108073 SureCart < 4.9.5 - Unauthenticated Private Catalog Data Disclosure via 'expand' Parameter
The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API, nor strip private fields from those objects, allowing unauthenticated users to read merchant-private catalog data such as...
CVE-2026-110514 WPZOOM Portfolio < 1.4.34 - Contributor+ Arbitrary Post/Page Type Overwrite via IDOR
The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order, which could allow users with the contributor role and above to convert any other user's posts and pages into portfolio items, removing them from their...
CVE-2026-108073 SureCart < 4.9.5 - Unauthenticated Private Catalog Data Disclosure via 'expand' Parameter
The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API, nor strip private fields from those objects, allowing unauthenticated users to read merchant-private catalog data such as...
CVE-2026-110514
The WPZOOM Portfolio Lite WordPress plugin (versions before 1.4.34 ) contains an Authorization Bypass vulnerability (CWE-639). The application fails to verify if a user has the necessary permissions to edit a post before allowing modifications to its type and order . This flaw enables users with ...
EUVD-2026-107068
The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order, which could allow users with the contributor role and above to convert any other user's posts and pages into portfolio items, removing them from their...
CVE-2026-110514 WPZOOM Portfolio < 1.4.34 - Contributor+ Arbitrary Post/Page Type Overwrite via IDOR
The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order, which could allow users with the contributor role and above to convert any other user's posts and pages into portfolio items, removing them from their...
CVE-2026-109926 Productive Commerce < 1.1.49 - Subscriber+ Arbitrary Plugin Activation
The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbitrary Productive Commerce WordPress plugin befo...
EUVD-2026-107067
The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbitrary Productive Commerce WordPress plugin befo...
CVE-2026-109926 Productive Commerce < 1.1.49 - Subscriber+ Arbitrary Plugin Activation
The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbitrary Productive Commerce WordPress plugin befo...
CVE-2026-109147 WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter
The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators...
WordPress Productive Commerce plugin < 1.1.49 - Subscriber+ Arbitrary Plugin Activation vulnerability
Subscriber+ Arbitrary Plugin Activation vulnerability discovered by Daniel Dhaniswara in WordPress Plugin Productive Commerce versions 1.1.49...
CVE-2026-109926
The Productive Commerce WordPress plugin, in versions prior to 1.1.49 , is vulnerable to unauthorized plugin activation due to a missing capability check in one of its AJAX actions. Because the plugin exposes the required nonce on every admin-area page, any authenticated user , such as a subscrib...
CVE-2026-109147 WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter
The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators...
CVE-2026-107788 SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide...
CVE-2026-107788
The SmartyParcel WordPress plugin (also known as WC Ukr Shipping ) before version 1.23.4 is vulnerable to a missing authorization check. This flaw allows any authenticated user , such as a subscriber, to delete shipping label and tracking records for arbitrary orders across the entire store. No s...