CVE-2026-81281

Subscriber Cross Site Scripting XSS in Graphene = 2.9.4 versions...

CVE-2026-84836

WC Ukraine Shipping is a WordPress plugin affected by an Insecure Direct Object References (IDOR) vulnerability in versions 1.22.3 and earlier . The flaw allows a low-privilege user (Subscriber level) to access restricted objects, resulting in high confidentiality impact and low integrity impact,...

CVE-2026-84836 WordPress WC Ukraine Shipping plugin <= 1.22.3 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in WC Ukraine Shipping = 1.22.3 versions...

EUVD-2026-70568

Subscriber Insecure Direct Object References IDOR in WC Ukraine Shipping = 1.22.3 versions...

CVE-2026-84814

CVE-2026-84814 affects the WordPress Bricksforge plugin in versions 3.1.8.8 and below , introducing a Subscriber Privilege Escalation vulnerability. According to the PatchStack CVSS 3.1 assessment, the vulnerability is rated CRITICAL (9.8) with a network attack vector, low complexity, no required...

EUVD-2026-70560

Subscriber Privilege Escalation in Bricksforge = 3.1.8.8 versions...

CVE-2026-84814 WordPress Bricksforge plugin <= 3.1.8.8 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Bricksforge = 3.1.8.8 versions...

EUVD-2026-70571

Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents = 1.51.0 versions...

CVE-2026-84779

Agentimus – AI SEO, llms.txt & MCP for AI Agents WordPress plugin versions

CVE-2026-84779 WordPress Agentimus – AI SEO, llms.txt & MCP for AI Agents plugin <= 1.51.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents = 1.51.0 versions...

EUVD-2026-70586

Subscriber Privilege Escalation in WCFM Membership = 2.11.11 versions...

CVE-2026-84756

CVE-2026-84756 is a privilege escalation vulnerability affecting the WCFM Membership WordPress plugin in versions 2.11.11 and below . The flaw allows a user with Subscriber privileges to escalate their access level. The vulnerability is rated HIGH (CVSS 3.1: 7.1) , with a network attack vector, l...

EUVD-2026-70595

Subscriber Cross Site Scripting XSS in Product Variations Swatches for WooCommerce = 1.1.18 versions...

CVE-2026-81282 WordPress Product Variations Swatches for WooCommerce plugin <= 1.1.18 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Product Variations Swatches for WooCommerce = 1.1.18 versions...

EUVD-2026-70596

Subscriber Cross Site Scripting XSS in Graphene = 2.9.4 versions...

CVE-2026-81281 WordPress Graphene theme <= 2.9.4 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Graphene = 2.9.4 versions...

CVE-2026-81282

Product Variations Swatches for WooCommerce (WordPress plugin) versions

CVE-2026-81281

CVE-2026-81281 is a Cross-Site Scripting (XSS) vulnerability in the Graphene WordPress theme , affecting versions 2.9.4 and earlier . The vulnerability requires a subscriber-level account (low privileges) and user interaction to be exploited. The CVSS v3.1 base score is 6.5 (MEDIUM) with a vector...

CVE-2025-15260

CVE-2025-15260: प्लगइन में लापता प्राधिकरण / टूटा एक्सेस नियंत्रण - MyRewards – लॉयल्टी पॉइंट्स और WooCommerce के लिए पुरस्कार अस्वीकरण: यह रिपॉजिटरी केवल शैक्षिक उद्देश्यों और नैतिक प्रकटीकरण के लिए बनाई गई है। इस कमजोरी की सूचना जिम्मेदारी से विक्रेता को दी गई है और इसे पैच किया जा चुका है। उचि...

CVE-2025-15481 Notification Bar for WordPress <= 1.1.8 – Unauthenticated Subscriber Data Disclosure

The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails...