WordPress NotificationX plugin < 3.3.7 - Unauthenticated Settings Update and Email Sending vulnerability

Unauthenticated Settings Update and Email Sending vulnerability discovered by Kevin Whelan in WordPress Plugin NotificationX versions 3.3.7...

NetAlertX 23.01.14–24.x < 24.10.12 - Remote Code Execution

NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authentication requirement, as exploited in the wild in May 2025. This is related to settings.php and util.php. id: CVE-2024-46506 info: name:...

CVE-2026-123131 GemBooking < 1.7.1 - Staff+ Arbitrary Post Deletion and Site Settings Update via REST Context Check Bypass

The GemBooking WordPress plugin before 1.7.1 does not properly verify that a REST request is addressed to its own routes before temporarily granting staff users administrative capabilities, allowing users with the GemBooking WordPress plugin before 1.7.1's Staff role to delete arbitrary posts and...

WordPress GemBooking plugin < 1.7.1 - Staff+ Arbitrary Post Deletion and Site Settings Update vulnerability

Staff+ Arbitrary Post Deletion and Site Settings Update vulnerability discovered by c0redumpsec in WordPress Plugin GemBooking Appointment Booking, Booking Calendar & Reservations versions 1.7.1...

CVE-2026-123131 GemBooking < 1.7.1 - Staff+ Arbitrary Post Deletion and Site Settings Update via REST Context Check Bypass

The GemBooking WordPress plugin before 1.7.1 does not properly verify that a REST request is addressed to its own routes before temporarily granting staff users administrative capabilities, allowing users with the GemBooking WordPress plugin before 1.7.1's Staff role to delete arbitrary posts and...

CVE-2026-123131

The GemBooking WordPress plugin (versions before 1.7.1 ) is vulnerable to an incorrect authorization issue (CWE-863 ). The plugin fails to properly verify if a REST request is directed at its own routes before granting Staff users temporary administrative capabilities. This allows users with the ...

WordPress WP Google Review Slider plugin < 18.11 - Google API Settings Update vulnerability

Google API Settings Update vulnerability discovered by Abdullah Kareem in WordPress Plugin WP Google Review Slider versions 18.11...

WordPress DT Directory Lite Addon plugin <= 1.1 - Unauthenticated Plugin Settings Update vulnerability

Unauthenticated Plugin Settings Update vulnerability discovered by Usama Arshad in WordPress Plugin DT Directory Lite Addon versions = 1.1...

WordPress Contact Form by Supsystic plugin < 1.11.1 - Arbitrary Plugin Settings Update vulnerability

Arbitrary Plugin Settings Update vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Contact Form by Supsystic versions 1.11.1...

WordPress InstaWP Connect plugin < 0.1.4.2 - Authenticated Plugin Settings Update vulnerability

Authenticated Plugin Settings Update vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin InstaWP Connect versions 0.1.4.2...

WordPress Download Manager plugin 4.0.0-7.5.8 - Privacy Settings Update vulnerability

Privacy Settings Update vulnerability discovered by Kartik Sharma in WordPress Plugin Download Manager versions 4.0.0-7.5.8...

WordPress Download Manager plugin < 3.3.71 - Privacy Settings Update vulnerability

Privacy Settings Update vulnerability discovered by Kartik Sharma in WordPress Plugin Download Manager versions 3.3.71...

WordPress Smush plugin < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on Multisite vulnerability

Admin+ Network-Wide Plugin Settings Update on Multisite vulnerability discovered by Erwan LR WPScan in WordPress Plugin Smush Image Compression and Optimization versions 4.3.4...

WordPress KeyWord Collector plugin <= 1.4 - Unauthenticated Stored XSS and Settings Update vulnerability

Unauthenticated Stored XSS and Settings Update vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin KeyWord Collector versions = 1.4...

CVE-2026-88905

The KeyWord Collector WordPress plugin, affecting versions through 1.4 , is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) and unauthorized settings updates. The root cause is a lack of authorisation or nonce checks when saving settings via WPKeyWordSettings, combined with a fail...

CVE-2026-88905 KeyWord Collector <= 1.4 - Unauthenticated Stored XSS and Settings Update via WPKeyWordSettings

The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector...

CVE-2026-88905 KeyWord Collector <= 1.4 - Unauthenticated Stored XSS and Settings Update via WPKeyWordSettings

The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector...

CVE-2026-103305 Prenotazioni <= 1.7.5 - Unauthenticated Stored XSS via Settings Update

The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors...

CVE-2026-103305

The Prenotazioni WordPress plugin (versions through 1.7.5 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a lack of authorisation and CSRF checks when saving settings, combined with insufficient escaping of those settings when they are outputted. This allows unauthenticat...

CVE-2026-103305 Prenotazioni <= 1.7.5 - Unauthenticated Stored XSS via Settings Update

The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors...