CVE-2026-66599

CVE-2026-66599 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin WPComplete , affecting versions 2.9.5.6 and earlier . The vulnerability was discovered by Asim Alshaya and carries a CVSS v3.1 score of 7.1 (HIGH) with a scope change (CHANGED), reflecting the ab...

CVE-2026-66599 WordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WPComplete = 2.9.5.6 versions...

CVE-2026-66584 WordPress 12 Step Meeting List plugin <= 3.19.16 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in 12 Step Meeting List = 3.19.16 versions...

EUVD-2026-64830

Unauthenticated Cross Site Scripting XSS in 12 Step Meeting List = 3.19.16 versions...

CVE-2026-78291 WordPress RepairBuddy plugin <= 4.1223 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in RepairBuddy = 4.1223 versions...

WordPress Royal MCP plugin < 1.4.26 - Subscriber+ Insufficient Authorization in MCP Tools vulnerability

Subscriber+ Insufficient Authorization in MCP Tools vulnerability discovered by Alessandro Greco aka Aleff, Giovanbattista Ianni University of Calabria - UNICAL in WordPress Plugin Royal MCP versions 1.4.26...

WordPress WANotifier plugin < 2.6 - Subscriber+ LFI vulnerability

Subscriber+ LFI vulnerability discovered by Project Black in WordPress Plugin Notifier versions 2.6...

WordPress Booking Hub plugin <= 1.3.0 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Jamaal ahmed in WordPress Plugin Booking Hub versions = 1.3.0...

WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Jamaal ahmed in WordPress Plugin UltimateAI versions = 3.1.0...

WordPress Content Protector (Passster) plugin < 4.3.9 - Unauthenticated Protected Content Disclosure via REST Path Allowlist Bypass vulnerability

Unauthenticated Protected Content Disclosure via REST Path Allowlist Bypass vulnerability discovered by Erwan LR WPScan in WordPress Plugin Passster versions 4.3.9...

WordPress Charitable plugin < 1.8.12 - Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass vulnerability

Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Charitable versions 1.8.12...

WordPress LitExtension: Store to WooCommerce Migration plugin <= 1.2.5 - Connector Token Takeover via CSRF vulnerability

Connector Token Takeover via CSRF vulnerability discovered by marim00 in WordPress Plugin LitExtension: WooCommerce Migration Plugin versions = 1.2.6...

WordPress Eventin plugin < 4.1.21 - Contributor+ Server-Side Request Forgery vulnerability

Contributor+ Server-Side Request Forgery vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin WP Event SOlution versions 4.1.21...

WordPress Drag and Drop Multiple File Upload for Contact Form 7 plugin < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass vulnerability

Unauthenticated RCE via Control Character Filename Bypass vulnerability discovered by Jakub Herman in WordPress Plugin Drag and Drop Multiple File Upload – Contact Form 7 versions 1.3.9.9...

WordPress Copy & Delete Posts plugin < 1.5.6 - Authenticated Arbitrary Post Content and Password Disclosure vulnerability

Authenticated Arbitrary Post Content and Password Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin Duplicate Post versions 1.5.6...

WordPress Copy & Delete Posts plugin < 1.5.6 - Author+ Password-Protected Post Content Disclosure vulnerability

Author+ Password-Protected Post Content Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin Duplicate Post versions 1.5.6...

WordPress MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator plugin <= 1.4 - Local File Inclusion vulnerability

WordPress MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator plugin = 1.4 - Local File Inclusion vulnerability discovered by Jamaal ahmed in WordPress Plugin MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator versions = 1.4...

WordPress Boost plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by luc in WordPress Plugin Boost versions = 2.0.4...

WordPress Tamara Checkout plugin <= 1.9.9.20 - Unauthenticated Order Status Manipulation vulnerability

Unauthenticated Order Status Manipulation vulnerability discovered by Ezekiel Victor in WordPress Plugin Tamara Checkout versions = 1.9.9.20...

WordPress Media Library Assistant plugin < 3.40 - Author+ SQL Injection via mla_search_connector vulnerability

Author+ SQL Injection via mlasearchconnector vulnerability discovered by João Ramos Maciel in WordPress Plugin Media LIbrary Assistant versions 3.40...