CVE-2026-66699: Missing Authorization

Custom role Broken Access Control in Dokan = 5.0.10 versions...

CVE-2026-66694: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Thrive Architect = 10.9.3.1 versions...

CVE-2026-66690: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in GiveWP = 4.16.5 versions...

CVE-2026-66688: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Ultimate Addons for Elementor = 1.45.2 versions...

CVE-2026-66686: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Plugins Garbage Collector Database Cleanup = 0.14 versions...

CVE-2026-66664: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in SEO Plugin by Squirrly SEO = 14.2.0 versions...

CVE-2026-66452: Missing Authorization

Unauthenticated Broken Access Control in Legal Text Connector of the IT-Recht Kanzlei = 1.0.13 versions...

CVE-2026-66451: Authentication Bypass Using an Alternate Path or Channel

Unauthenticated Broken Authentication in WP Event SOlution = 4.1.9 versions...

CVE-2026-66425: Authentication Bypass Using an Alternate Path or Channel

Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder = 1.9.0 versions...

CVE-2026-65581: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in AI ANN = 1.29.0 versions...

CVE-2026-65577: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Advice = 1.18.0 versions...

CVE-2026-65572: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in A.Williams = 1.3.1 versions...

CVE-2026-65560: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Houzez Property Feed = 2.5.48 versions...

CVE-2026-65556: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in WPBruiser no- Captcha anti-Spam = 3.1.43 versions...

CVE-2026-65544: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Super Socializer = 7.14.5 versions...

CVE-2026-65513: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Simply Schedule Appointments = 1.6.12.10 versions...

CVE-2026-65508: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Simply Schedule Appointments = 1.6.12.10 versions...

CVE-2026-65507: Incorrect Privilege Assignment

Unauthenticated Privilege Escalation in AIWU = 1.5.6 versions...

CVE-2026-65504: Missing Authorization

Unauthenticated Broken Access Control in BOX NOW Delivery Croatia = 3.3.0 versions...

CVE-2026-65502: Authentication Bypass by Spoofing

Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons = 8.7.13 versions...