CVE-2026-75930

FundEngine – Donation and Crowdfunding Platform for WordPress (all versions up to and including 1.8.1 ) suffers from an authorization bypass due to missing authorization verification. An authenticated attacker with subscriber-level access or above can modify arbitrary posts and pages — overwritin...

CVE-2026-19801

The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

EUVD-2026-65193

The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

CVE-2026-19801 BetterLinks <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation via create_fbs_link AJAX Action

The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

WordPress BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Short URL Creation vulnerability discovered by Wordfence PRISM in WordPress Plugin BetterLinks versions = 3.1.0...

EUVD-2026-65167

Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

EUVD-2026-65166

Subscriber Privilege Escalation in Booking Hub = 1.3.0 versions...

EUVD-2026-65165

Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator = 1.4 versions...

EUVD-2026-65164

Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...

CVE-2022-1051

CVE-2022-1051 WPQA 5.2 - Cross-Site Scripting Stored Subscriber+ tramite i campi del profilo Descrizione Il plugin, utilizzato come plugin complementare per i temi Discy e Himer, non sanitizza e non esegue l'escape dei campi città, telefono o credenziali del profilo quando li restituisce nella...

CVE-2026-32563

Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

CVE-2026-32559

Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...

CVE-2026-32563 WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

CVE-2026-32563 WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

CVE-2026-32560 WordPress MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator plugin <= 1.4 - Local File Inclusion vulnerability

Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator = 1.4 versions...

CVE-2026-32560 WordPress MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator plugin <= 1.4 - Local File Inclusion vulnerability

Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator = 1.4 versions...

CVE-2026-32560

MagicAI for WordPress (AI Text, Image, Chat, Code, and Voice Generator) plugin versions ≤ 1.4 are affected by a Local File Inclusion (LFI) vulnerability accessible to authenticated users with the Subscriber role. The vulnerability is rated CVSS 8.8 (HIGH) by Patchstack, with a network attack vect...

CVE-2026-32559 WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...

CVE-2026-27364 WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability

Subscriber Broken Access Control in Style Kits = 2.6.5 versions...

CVE-2024-51665

CVE-2024-51665 Magical Addons For Elementor = 1.2.1 - Server-Side Request Forgery Autenticato Abbonato+ Descrizione: Il plugin Magical Addons For Elementor Header Footer Builder, Free Elementor Widgets, Elementor Templates Library per WordPress è vulnerabile a Server-Side Request Forgery in tutte...