CVE-2026-86826 BackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Working Directory on NGINX

The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive database dump and site...

WordPress Appointment Booking Plugin plugin < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion vulnerability

Agent+ Arbitrary Order, Customer and Transaction Deletion vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin LatePoint versions 5.6.5...

EUVD-2026-94768

The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API actions, allowing an authenticated user holding the LatePoint Agent role, normally restricted to their own records, to read and modify other agents' profile da...

WordPress Appointment Booking Plugin plugin < 5.7.3 - Unauthenticated Customer PII Disclosure vulnerability

Unauthenticated Customer PII Disclosure vulnerability discovered by Vũ Quang Huy in WordPress Plugin LatePoint versions 5.7.3...

CVE-2026-105197 LatePoint < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion via IDOR

The Appointment Booking Plugin WordPress plugin before 5.6.5 does not verify that a backend staff user is authorized to act on the specific record targeted for deletion, allowing an authenticated user with a record-scoped staff role to irreversibly delete any order, customer, or transaction on th...

CVE-2026-105197 LatePoint < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion via IDOR

The Appointment Booking Plugin WordPress plugin before 5.6.5 does not verify that a backend staff user is authorized to act on the specific record targeted for deletion, allowing an authenticated user with a record-scoped staff role to irreversibly delete any order, customer, or transaction on th...

CVE-2026-105260 Database Addon For WPForms < 1.1.1 - Arbitrary Form Entry Deletion via CSRF

The Database Addon For WPForms wpforms entries WordPress plugin before 1.1.1 does not verify the CSRF nonce when the field is omitted and performs no capability check of its own, allowing attackers to delete arbitrary stored form entries by tricking a logged-in administrator into loading a crafte...

WordPress Appointment Booking Plugin plugin < 5.6.9 - Agent+ Cross-Agent Data Disclosure and Modification vulnerability

Agent+ Cross-Agent Data Disclosure and Modification vulnerability discovered by Artus KG in WordPress Plugin LatePoint versions 5.6.9...

EUVD-2026-94770

The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced by an order-item identifier before rendering that order's confirmation summary, letting an unauthenticated visitor retrieve any customer's name, contact details and order...

EUVD-2026-94769

The Appointment Booking Plugin WordPress plugin before 5.6.5 does not verify that a backend staff user is authorized to act on the specific record targeted for deletion, allowing an authenticated user with a record-scoped staff role to irreversibly delete any order, customer, or transaction on th...

CVE-2026-86826

The BackWPup WordPress plugin, in versions before 5.7.7 , fails to properly restrict web access to the working directory utilized during backup restores. On webservers that do not honor .htaccess rules, such as NGINX , unauthenticated attackers can download full backup archives left behind by int...

CVE-2026-86826 BackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Working Directory on NGINX

The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive database dump and site...

CVE-2026-105193 Booking Calendar < 11.8 - Unauthenticated Booking Information Disclosure and Modification via Predictable Booking Hash

The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a low-entropy time-seeded value, which can allow unauthenticated attackers who are able to determine a booking's creation time to predict the hash and then...

CVE-2026-105195

The Booking Calendar WordPress plugin (versions 10.15 - 11.8.2 ) contains a vulnerability where it fails to adequately restrict which options a lower-privileged user can load through one of its settings handlers . This flaw allows users with the Editor role and above to disclose the values of arb...

CVE-2026-105195 Booking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option Disclosure

The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site...

CVE-2026-105193

The Booking Calendar WordPress plugin, in versions before 11.8 , is vulnerable to unauthenticated booking information disclosure and modification. The root cause is the use of insufficient entropy when generating per-booking access hashes, as they are derived from a low-entropy time-seeded value ...

CVE-2026-103646 Ultimate Multisite < 2.17.0 - Unauthenticated Authentication Bypass via 'email_address' Parameter

The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the looku...

CVE-2026-104646

The Image Photo Gallery Final Tiles Grid WordPress plugin, versions prior to 3.6.14 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the insufficient sanitization of gallery configuration values that can be overridden via the plugin's gallery shortcode . These values...

CVE-2026-103692 Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation via Arbitrary Function Call

The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including...

CVE-2026-103646 Ultimate Multisite < 2.17.0 - Unauthenticated Authentication Bypass via 'email_address' Parameter

The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the looku...