CVE-2026-81756 WordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.1.24 - SQL Injection vulnerability

Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms = 5.1.24 versions...

CVE-2026-81758

CVE-2026-81758 is a Broken Access Control vulnerability in the WordPress plugin OwnerRez API , affecting versions ≤ 1.2.6 . The flaw allows users with the Subscriber role to perform actions they should not be authorized for, as discovered by JunHee CHO via PatchStack. The CNA-assigned CVSS 3.1 sc...

CVE-2026-81298

Unauthenticated Cross-Site Scripting (XSS) was identified in the WordPress LeadConnector plugin, affecting versions 4.0.5 and earlier . The vulnerability, discovered by daroo , allows an unauthenticated attacker to execute arbitrary scripts in a victim's browser context, with a CVSS 3.1 score of ...

CVE-2026-81298 WordPress LeadConnector plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in LeadConnector = 4.0.5 versions...

CVE-2026-81296 WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81297

Fluent Forms Pro Add On Pack is a WordPress plugin affected by a Subscriber Privilege Escalation vulnerability in versions ≤ 6.2.12 , as discovered by Ananda Dhakal (Patchstack). The CVSS 3.1 score is 7.5 (HIGH) with the vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a network-based attac...

CVE-2026-81296

CVE-2026-81296 affects the WordPress plugin Fluent Forms Pro Add On Pack (versions

CVE-2026-81297 WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81293

CVE-2026-81293 is an unauthenticated SQL injection vulnerability in the WP Data Access WordPress plugin, affecting versions 5.5.81 and below . The flaw was discovered by sequence_X0 and reported via Patchstack. The CVSS v3.1 score is 9.3 (Critical) , with a network attack vector, low complexity, ...

CVE-2026-81293 WordPress WP Data Access plugin <= 5.5.81 - SQL Injection vulnerability

Unauthenticated SQL Injection in WP Data Access = 5.5.81 versions...

CVE-2026-81290

CVE-2026-81290 is an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress plugin Email Subscribers & Newsletters , affecting versions ≤ 5.9.33 . The vulnerability was discovered by Jiemook and rated CVSS 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicat...

CVE-2026-81290 WordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Email Subscribers & Newsletters = 5.9.33 versions...

CVE-2026-81287

CVE-2026-81287 affects the WordPress Charitable plugin in versions 1.8.12.1 and earlier , where a subscriber-level SQL injection vulnerability exists. The flaw allows an authenticated subscriber to exploit a SQL injection, with a CVSS 3.1 score of 8.5 (HIGH) . The vector CVSS:3.1/AV:N/AC:L/PR:L/U...

CVE-2026-81287 WordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerability

Subscriber SQL Injection in Charitable = 1.8.12.1 versions...

CVE-2026-82852 WordPress MapSVG plugin <= 8.15.0 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery SSRF in MapSVG = 8.15.0 versions...

Updated perl-Catalyst-Plugin-Authentication packages fix a security vulnerability

Catalyst::Plugin::Authentication versions before 0.10027 for Perl are susceptible to session fixation attacks. CVE-2009-10007...

MGASA-2026-0351 Updated perl-Catalyst-Plugin-Authentication packages fix a security vulnerability

Catalyst::Plugin::Authentication versions before 0.10027 for Perl are susceptible to session fixation attacks. CVE-2009-10007...

WordPress WCFM Marketplace plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WCFM Marketplace versions = 3.8.2...

CVE-2026-83497 Unrestricted Java Deserialization in OpenSearch SQL Plugin Cursor Pagination

Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search permissions to execute arbitrary code on the server by sending a crafted cursor parameter to the plugins/sql endpoint...

CVE-2026-83497

CVE-2026-83497 is an unrestricted Java deserialization vulnerability in the cursor pagination component of the OpenSearch SQL plugin . A remote authenticated user with basic read/search permissions can execute arbitrary code on the server by sending a crafted cursor parameter to the /_plugins/_sq...