EUVD-2026-64788

Contributor Cross Site Scripting XSS in Magazine Blocks = 1.8.6 versions...

CVE-2026-78280 WordPress Hash Form plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Hash Form = 1.4.0 versions...

CVE-2026-78279 WordPress Fluent Support Pro plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Fluent Support Pro = 2.3.1 versions...

CVE-2026-78279 WordPress Fluent Support Pro plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Fluent Support Pro = 2.3.1 versions...

CVE-2026-78277 WordPress FluentCRM Pro plugin <= 3.1.12 - Server Side Request Forgery (SSRF) vulnerability

Subscriber Server Side Request Forgery SSRF in FluentCRM Pro = 3.1.12 versions...

CVE-2026-78278 WordPress Fluent Boards Pro plugin <= 2.0.11 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Fluent Boards Pro = 2.0.11 versions...

CVE-2026-78278

Fluent Boards Pro is a WordPress plugin affected by a Subscriber-level Insecure Direct Object Reference (IDOR) vulnerability in versions ≤ 2.0.11 . The flaw is reachable over the network with no privileges required and low attack complexity , allowing an unauthenticated attacker to access objects...

CVE-2026-78277 WordPress FluentCRM Pro plugin <= 3.1.12 - Server Side Request Forgery (SSRF) vulnerability

Subscriber Server Side Request Forgery SSRF in FluentCRM Pro = 3.1.12 versions...

CVE-2026-78278 WordPress Fluent Boards Pro plugin <= 2.0.11 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Fluent Boards Pro = 2.0.11 versions...

CVE-2026-78272 WordPress Fluent Support Pro plugin <= 2.3.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in Fluent Support Pro = 2.3.1 versions...

CVE-2026-78272 WordPress Fluent Support Pro plugin <= 2.3.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in Fluent Support Pro = 2.3.1 versions...

EUVD-2026-64835

Author SQL Injection in FluentCRM Pro = 3.1.12 versions...

CVE-2026-78270 WordPress FluentCRM Pro plugin <= 3.1.12 - SQL Injection vulnerability

Author SQL Injection in FluentCRM Pro = 3.1.12 versions...

CVE-2026-78269 WordPress Shared Files plugin <= 1.7.69 - Server Side Request Forgery (SSRF) vulnerability

Contributor Server Side Request Forgery SSRF in Shared Files = 1.7.69 versions...

CVE-2026-78269 WordPress Shared Files plugin <= 1.7.69 - Server Side Request Forgery (SSRF) vulnerability

Contributor Server Side Request Forgery SSRF in Shared Files = 1.7.69 versions...

CVE-2026-78258 WordPress Booking and Rental Manager plugin <= 2.7.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Booking and Rental Manager = 2.7.5 versions...

CVE-2026-78258 WordPress Booking and Rental Manager plugin <= 2.7.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Booking and Rental Manager = 2.7.5 versions...

CVE-2026-66623 WordPress Social Media & Share Icons plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Social Media & Share Icons = 2.9.9 versions...

CVE-2026-66623 WordPress Social Media & Share Icons plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Social Media & Share Icons = 2.9.9 versions...

CVE-2026-66623

CVE-2026-66623 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Social Media & Share Icons (also known as Ultimate Social Media Icons), affecting versions 2.9.9 and below . The vulnerability was discovered by Bonds and carries a CVSS 3.1 score of 7.1 (HIGH) ,...