CVE-2026-75020

This LDAP Injection vulnerability in Apache APISIX's ldap-auth plugin (versions 2.11.0 through 3.17.0 ) allows a caller holding valid credentials for one LDAP directory entry to authenticate as a consumer mapped to a different entry, effectively bypassing the plugin's configured scope and enablin...

CVE-2026-81274

The WordPress Ditty (News Ticker) plugin (versions

CVE-2026-81276

CVE-2026-81276 affects the Kali Forms WordPress plugin in versions 2.4.23 and earlier . The vulnerability is an unauthenticated Broken Access Control flaw, rated CVSS 5.3 (Medium) with an attack vector of network, low complexity, no required privileges, and a low impact on integrity. The issue wa...

CVE-2026-81274 WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability

Subscriber Broken Access Control in Ditty = 3.1.67 versions...

CVE-2026-81276 WordPress Kali Forms plugin <= 2.4.23 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Kali Forms = 2.4.23 versions...

CVE-2026-81273 WordPress FluentBooking Pro plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in FluentBooking Pro = 2.2.4 versions...

CVE-2026-81273

FluentBooking Pro (WordPress plugin, versions

CVE-2026-81271 WordPress GeoDirectory plugin <= 2.8.176 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in GeoDirectory = 2.8.176 versions...

CVE-2026-81271

An unauthenticated Cross-Site Request Forgery (CSRF) vulnerability affects the WordPress GeoDirectory plugin in versions 2.8.176 and earlier . The flaw was discovered by Brian Willows and carries a CVSS 3.1 score of 8.8 (HIGH) , with network attack vector, low complexity, no privileges required, ...

CVE-2026-81272 WordPress FluentPlayer Pro plugin <= 1.3.2 - Broken Access Control vulnerability

Editor Broken Access Control in FluentPlayer Pro = 1.3.2 versions...

CVE-2026-81272

CVE-2026-81272 affects the WordPress FluentPlayer Pro plugin in versions 1.3.2 and below , where an Editor-level Broken Access Control flaw allows a user with the Editor role to perform actions they should not be permitted to. The CVSS 3.1 score is 4.9 (MEDIUM) with the vector AV:N/AC:L/PR:H/UI:N...

CVE-2026-80433 WordPress SureFeedback Client Site plugin <= 1.2.12 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in SureFeedback Client Site = 1.2.12 versions...

CVE-2026-80433

SureFeedback Client Site is a WordPress plugin vulnerable to Subscriber-level Sensitive Data Exposure in versions 1.2.12 and below . The CVSS 3.1 score is 7.5 (High) , with a network attack vector requiring no privileges or user interaction, and a high impact on confidentiality but no impact on i...

CVE-2026-78293 WordPress WP w3all phpBB plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WP w3all phpBB = 3.0.6 versions...

CVE-2026-78293

CVE-2026-78293 affects the WordPress plugin WP w3all phpBB (versions ≤ 3.0.6 ), where an unauthenticated Cross Site Scripting (XSS) vulnerability was identified. The issue was discovered by lanlv – HPT Vietnam Corporation and reported via Patchstack. The CVSS 3.1 score is 7.1 (HIGH) with vector A...

CVE-2026-78292

CVE-2026-78292 is an unauthenticated PHP Object Injection vulnerability in the WordPress plugin Hash Form , affecting versions

CVE-2026-78292 WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...

CVE-2026-78288 WordPress Beautiful Taxonomy Filters plugin <= 2.4.6 - SQL Injection vulnerability

Unauthenticated SQL Injection in Beautiful Taxonomy Filters = 2.4.6 versions...

CVE-2026-78288

The WordPress plugin Beautiful Taxonomy Filters (versions

CVE-2026-78286

CVE-2026-78286 affects the WordPress Geo Controller plugin in versions ≤ 8.9.8 . The vulnerability is an unauthenticated PHP Object Injection , meaning an attacker can trigger it over the network without any credentials or user interaction. The CNA (Patchstack) assigned a CVSS 3.1 score of 9.8 (C...