WordPress Salon booking system plugin <= 10.31.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Daniel Dhaniswara in WordPress Plugin Salon booking system versions = 10.31.1...

WordPress Salon booking system plugin <= 10.31.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Salon booking system versions = 10.31.1...

WordPress CubeWP plugin <= 1.1.31 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin CubeWP versions = 1.1.31...

WordPress WP Photo Album Plus plugin < 9.2.07.002 - Unauthenticated Export ZIP File Deletion via delexportzips vulnerability

Unauthenticated Export ZIP File Deletion via delexportzips vulnerability discovered by Vaibhav Narkhede in WordPress Plugin WP Photo Album Plus versions 9.2.07.002...

WordPress Nexter Blocks plugin < 5.0.2 - Contributor+ Stored CSS Injection vulnerability

Contributor+ Stored CSS Injection vulnerability discovered by Vaibhav Narkhede in WordPress Plugin Nexter Blocks versions 5.0.2...

WordPress DHL for WooCommerce plugin < 4.0.1 - Unauthenticated Shipping Label Disclosure via Unprotected Uploads Directory vulnerability

Unauthenticated Shipping Label Disclosure via Unprotected Uploads Directory vulnerability discovered by Artus KG in WordPress Plugin DHL Shipping Germany for WooCommerce versions 4.0.1...

WordPress GeoDirectory plugin < 2.8.169 - Unauthenticated Pending/Draft Listing Disclosure via markers REST Endpoint vulnerability

Unauthenticated Pending/Draft Listing Disclosure via markers REST Endpoint vulnerability discovered by Usama Arshad in WordPress Plugin GeoDirectory versions 2.8.169...

WordPress DHL for WooCommerce plugin < 4.0.1 - Unauthenticated Shipping Label Download via IDOR vulnerability

Unauthenticated Shipping Label Download via IDOR vulnerability discovered by Pedro Pinho, Artus KG in WordPress Plugin DHL Shipping Germany for WooCommerce versions 4.0.1...

WordPress RSS Aggregator by Feedzy plugin < 5.2.6 - Author+ Cross-User Import Job Manipulation and Post Deletion vulnerability

Author+ Cross-User Import Job Manipulation and Post Deletion vulnerability discovered by Farid Narimanov in WordPress Plugin Feedzy versions 5.2.6...

WordPress Login & Register Forms plugin < 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password Response vulnerability

Unauthenticated Registered User Email Address Disclosure via Lost Password Response vulnerability discovered by Artus KG in WordPress Plugin Login/Signup Popup versions 4.0.2...

WordPress WP Maps Pro plugin < 6.1.3 - Unauthenticated Denial of Service vulnerability

Unauthenticated Denial of Service vulnerability discovered by Mohammad Aghdasi in WordPress Plugin Advanced Google Maps versions 6.1.3...

WordPress FoodBoxBooker plugin < 1.0.8 - Subscriber+ Arbitrary User Profile Update vulnerability

Subscriber+ Arbitrary User Profile Update vulnerability discovered by Erwan LR WPScan in WordPress Plugin FoodBoxBooker versions 1.0.8...

WordPress Bit File Manager plugin < 6.9.1 - Subscriber+ Sensitive Data Disclosure via bitapps_fm_connector vulnerability

Subscriber+ Sensitive Data Disclosure via bitappsfmconnector vulnerability discovered by JING QIAN in WordPress Plugin Bit File Manager versions 6.9.1...

WordPress Bit File Manager plugin < 6.9.1 - Unauthenticated File Activity Log Disclosure vulnerability

Unauthenticated File Activity Log Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin Bit File Manager versions 6.9.1...

WordPress MLS Import plugin < 7.0.4 - Subscriber+ Sensitive Information Disclosure via mlsimport_logger_per_item vulnerability

Subscriber+ Sensitive Information Disclosure via mlsimportloggerperitem vulnerability discovered by Shikhali Jamalzade in WordPress Plugin MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings versions 7.0.4...

CVE-2026-81279

Subscriber Broken Access Control in Push Notification for Post and BuddyPress = 3.20 versions...

CVE-2026-78288

Unauthenticated SQL Injection in Beautiful Taxonomy Filters = 2.4.6 versions...

CVE-2026-78293

Unauthenticated Cross Site Scripting XSS in WP w3all phpBB = 3.0.6 versions...

CVE-2026-78261

Unauthenticated Cross Site Scripting XSS in Realtyna Organic IDX plugin = 5.4.1 versions...

CVE-2026-78283

Unauthenticated Cross Site Scripting XSS in Music Player for WooCommerce = 1.8.9 versions...