CVE-2026-82227 WordPress WPBulky plugin <= 1.2.2 - SQL Injection vulnerability

Contributor SQL Injection in WPBulky = 1.2.2 versions...

CVE-2026-81284 WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability

Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...

WordPress OwnerRez API plugin <= 1.2.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by JunHee CHO in WordPress Plugin OwnerRez API versions = 1.2.6...

WordPress Booking and Rental Manager plugin <= 2.7.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by sungbyeongchan in WordPress Plugin Booking and Rental Manager versions = 2.7.6...

WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ionut Pipirig in WordPress Plugin Tickera versions = 3.6.0.2...

WordPress Email Essentials plugin <= 6.0.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by JunHee CHO in WordPress Plugin Email Essentials versions = 6.0.6...

WordPress Tailored Tools plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin Tailored Tools versions = 3.0.2...

WordPress Super Store Finder plugin <= 7.10 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Super Store Finder versions = 7.10...

WordPress SiteGround Security plugin <= 1.6.6 - 2FA Bypass vulnerability

2FA Bypass vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin SiteGround Security versions = 1.6.6...

WordPress WordPress Social Login and Register plugin <= 7.8.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WordPress Social Login and Register versions = 7.8.2...

CVE-2026-82328

A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate the usedclrs palette count parameter. This incorrect validation leads to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue c...

CVE-2026-82328 Gimp: heap out-of-bounds read in ico loader via unvalidated used_clrs palette count

A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate the usedclrs palette count parameter. This incorrect validation leads to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue c...

CVE-2026-82328

GIMP's file-ico plugin is vulnerable to a heap out-of-bounds read triggered when processing a specially crafted ICO image file. The root cause is improper validation of the used_clrs (palette count) parameter , which leads to incorrect memory bounds checking. The impact is an application crash (d...

WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by CoryRoo in WordPress Plugin Hash Form versions = 1.4.2...

WordPress Forminator Forms plugin < 1.57.0.7 - Authenticated Privilege Escalation vulnerability

Authenticated Privilege Escalation vulnerability discovered by Thanh Lam Tang in WordPress Plugin Forminator versions 1.57.0.7...

WordPress Booking for Appointments and Events Calendar plugin 9.0-9.7 - Provider+ Arbitrary Provider Password Update vulnerability

Provider+ Arbitrary Provider Password Update vulnerability discovered by Haitam Lazaar in WordPress Plugin Amelia versions 9.0-9.7...

WordPress Events Manager plugin <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter vulnerability

Reflected Cross-Site Scripting via 'headerformat' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Events Manager versions = 7.4.0.1...

WordPress All-in-One WP Migration Unlimited Extension plugin <= 2.84 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm_backups_path' Parameter vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via 'ai1wmbackupspath' Parameter vulnerability discovered by Rafie Muhammad - Awesome Motive, Inc. in WordPress Plugin All-in-One WP Migration Unlimited Extension versions = 2.84...

EUVD-2026-67721

A flaw was found in the file-iff IFF/ILBM plugin in GIMP. When processing a specially crafted IFF/ILBM image file, the plugin does not properly validate the HAM row size and improperly handles cases where the number of color planes nPlanes is zero. This causes a row size mismatch that bypasses...

CVE-2026-82324 Gimp: heap out-of-bounds reads in iff/ilbm loader from ham row size mismatch and nplanes=0

A flaw was found in the file-iff IFF/ILBM plugin in GIMP. When processing a specially crafted IFF/ILBM image file, the plugin does not properly validate the HAM row size and improperly handles cases where the number of color planes nPlanes is zero. This causes a row size mismatch that bypasses...