WordPress WP Go Maps plugin < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Marker ID vulnerability

Unauthenticated Sensitive Information Disclosure via Marker ID vulnerability discovered by Sudhanshu Chauhan RedHunt Labs in WordPress Plugin WP Go Maps versions 10.0.10...

WordPress Frontend File Manager Plugin plugin <= 23.6 - Author+ Arbitrary Post Deletion vulnerability

Author+ Arbitrary Post Deletion vulnerability discovered by Tiago Ferreira in WordPress Plugin Frontend File Manager versions = 23.6...

WordPress Really Simple Security plugin < 9.5.10.1 - Two-Factor OTP Bypass vulnerability

Two-Factor OTP Bypass vulnerability discovered by John Umoru in WordPress Plugin Really Simple SSL versions 9.5.10.1...

WordPress Eupago Gateway For Woocommerce plugin < 4.7.2 - Unauthenticated Arbitrary Refund Initiation vulnerability

Unauthenticated Arbitrary Refund Initiation vulnerability discovered by Pedro Pinho in WordPress Plugin Eupago Gateway For Woocommerce versions 4.7.2...

CVE-2026-18547 Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute)

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Textarea Profile Field with HTML Support DOM Gadget via id Attribute in all versions up to, and including, 2.12....

CVE-2026-18547 Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute)

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Textarea Profile Field with HTML Support DOM Gadget via id Attribute in all versions up to, and including, 2.12....

CVE-2026-77824 Media Sweep <= 1.1.3 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter

The Media Sweep – WordPress Media Cleaner plugin for WordPress is vulnerable to generic SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

CVE-2026-77824

Media Sweep – WordPress Media Cleaner (all versions up to and including 1.1.3 ) is affected by a SQL Injection vulnerability in the 'fields' parameter of its REST API. The root cause is insufficient escaping of the user-supplied parameter combined with lack of proper query preparation, as seen in...

EUVD-2026-65460

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Textarea Profile Field with HTML Support DOM Gadget via id Attribute in all versions up to, and including, 2.12....

CVE-2026-18547

CVE-2026-18547 affects the Ultimate Member WordPress plugin in all versions up to and including 2.12.1 . Authenticated attackers with subscriber-level access or above can exploit a stored XSS (DOM-based) by injecting malicious JavaScript through a textarea profile field with HTML support. The roo...

CVE-2026-17587 My Agile Privacy® <= 3.3.6 - Missing Authorization to Unauthenticated Plugin Settings Modification via map_missing_cookie_shield / map_check_consent_mode_status AJAX Actions

The My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-19949 All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-75971 ShopEngine Elementor WooCommerce Builder Addon <= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import '<wp_option>' Nodes

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.4. This is due to the rumimporter function being registered on the WordPress core importstart action hook with ...

EUVD-2026-65461

The My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-17587

My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is affected by an authorization bypass in all versions up to and including 3.3.6 . The root cause is missing access-control checks on the map_missing_cookie_shield and map_check_consent_mode_status AJAX actions, allowing...

CVE-2026-75971 ShopEngine Elementor WooCommerce Builder Addon <= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import '<wp_option>' Nodes

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.4. This is due to the rumimporter function being registered on the WordPress core importstart action hook with ...

CVE-2026-17587 My Agile Privacy® <= 3.3.6 - Missing Authorization to Unauthenticated Plugin Settings Modification via map_missing_cookie_shield / map_check_consent_mode_status AJAX Actions

The My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-75908 Newsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter

The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and...

CVE-2026-75908 Newsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter

The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and...

EUVD-2026-65464

The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and...