CVE-2026-13358

The CVE concerns the WordPress plugin Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin. Affected: all versions up to and including 1.6.12.10. Issue: Insecure Direct Object Reference via the ssa_past_appointments key due to missing validation, allowing authenticated attac...

CVE-2026-13358

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.10 via the ssapastappointments due to missing validation on a user controlled key. This makes it...

PT-2026-73084

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.10 via the ssa past appointments due to missing validation on a user controlled key. This makes it...

Exploit for CVE-2026-9830

CVE-2026-9830 BookingPress Pro API Assessment PoC This reposi...

CVE-2026-18438

The CVE-2026-18438 entry concerns the Templately – Elementor & Gutenberg Template Library WordPress plugin (versions up to 3.7.1). Root cause: a filename validation/destination mismatch in fetch_remote_file causes the destination path to be derived from the URL, while the Content-Disposition file...

EUVD-2026-59601

The Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.7.1 via the fetchremotefile function. This is due to a filename validation/destination mismatch ...

CVE-2026-16541

The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered...

CVE-2026-16611

The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before 13.5.7 does not perform an authorization check on one of its REST read routes, allowing unauthenticated users to disclose a store's feed configuration rules, filters and field mapping and to enumerate the full product catego...

EUVD-2026-59589

The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered...

CVE-2026-16611

The Product Feed PRO for WooCommerce plugin (before 13.5.7) exposes a REST read route without authorization checks, letting unauthenticated attackers retrieve feed rules, filters, field mappings, and the full product category taxonomy. CVSS 3.1 scores this HIGH (7.5) for confidentiality impact. E...

CVE-2026-16541 Simply Schedule Appointments < 1.6.12.17 - Team Member+ User Email Disclosure via Users and Customers REST Endpoints

The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered...

CVE-2026-16611 Product Feed PRO for WooCommerce < 13.5.7 - Unauthenticated Feed Configuration Disclosure

The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before 13.5.7 does not perform an authorization check on one of its REST read routes, allowing unauthenticated users to disclose a store's feed configuration rules, filters and field mapping and to enumerate the full product catego...

EUVD-2026-59590

The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before 13.5.7 does not perform an authorization check on one of its REST read routes, allowing unauthenticated users to disclose a store's feed configuration rules, filters and field mapping and to enumerate the full product catego...

CVE-2026-16541

The Simply Schedule Appointments WordPress plugin (before 1.6.12.17) exposes user names and email addresses via its Users and Customers REST endpoints to any authenticated Team Member+ role, requiring only low privileges; the fix is to upgrade to version 1.6.12.17. No exploitation evidence is pro...

CVE-2026-15312

The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to the create function's REST endpoint failing to validate the user-supplied role parameter against an allowlist of permitted...

CVE-2026-15162

The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpressobjecttype parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback canprocess checks only the HTTP method for the push class — no capability or nonc...

Exploit for CVE-2026-13610

CVE-2026-13610 — KiviCare – Clinic & Patient Management System...

CVE-2026-15001

The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX actions savebloyalconfigurationdata and savebloyalaccesskeyverificationdata being registered without any capability or...

CVE-2026-15162

The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpressobjecttype parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback canprocess checks only the HTTP method for the push class — no capability or nonc...

CVE-2026-15162

The CVE-2026-15162 entry concerns the Object Sync for Salesforce WordPress plugin, where an unauthenticated SQL injection is possible via the wordpress_object_type parameter in the /wp-json/object-sync-for-salesforce/push/ REST route. The can_process() check only validates the HTTP method, not ca...