CVE-2026-28162: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...

CVE-2026-78269: Server-Side Request Forgery (SSRF)

Contributor Server Side Request Forgery SSRF in Shared Files = 1.7.69 versions...

CVE-2026-32477: Improper Limitation of a Pathname to a Restricted Directory

Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons = 2.2.0 versions...

CVE-2026-78258: Missing Authorization

Unauthenticated Broken Access Control in Booking and Rental Manager = 2.7.5 versions...

CVE-2026-59295: Undefined Security Weakness

It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service DoS condition due to an unbounded memory leak. Micrometer 1.17.0 Micrometer 1.16.0 - 1.16.6 Micrometer 1.15.0 - 1.15.12 Micrometer 1.14.0 - 1.14.16 Micrometer 1.9.18 and earlier...

CVE-2026-66584: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in 12 Step Meeting List = 3.19.16 versions...

CVE-2026-32478: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in WP Project Manager Pro = 4.0.1 versions...

CVE-2026-78272: Missing Authorization

Subscriber Broken Access Control in Fluent Support Pro = 2.3.1 versions...

CVE-2026-32555: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Boost = 2.0.4 versions...

CVE-2026-28166: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Tourmaster = 5.4.9 versions...

CVE-2026-28152: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Tonda Core 2.6 versions...

CVE-2026-32560: Improper Control of Filename for Include/Require Statement in PHP Program

Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator = 1.4 versions...

CVE-2026-78284: Improper Limitation of a Pathname to a Restricted Directory

Unauthenticated Arbitrary File Deletion in MasterStudy LMS = 3.7.42 versions...

CVE-2026-78290: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Magazine Blocks = 1.8.6 versions...

CVE-2026-66623: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Social Media & Share Icons = 2.9.9 versions...

CVE-2026-66587: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in WP Cafe Pro 3.0.15 versions...

CVE-2026-78279: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Fluent Support Pro = 2.3.1 versions...

CVE-2026-32554: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in WooBeWoo Product Filter Pro = 3.1.8 versions...

CVE-2026-28167: Improper Limitation of a Pathname to a Restricted Directory

Unauthenticated Arbitrary File Download in Super Forms = 6.3.315 versions...

CVE-2026-32559: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...