CVE-2026-8378: Undefined Security Weakness

The Frontend File Manager Plugin WordPress plugin through 23.6 does not sanitise nor escape a filename submitted to the frontend file-rename endpoint before storing it as post meta and rendering it back on the admin File Manager listing, leading to a Stored Cross-Site Scripting vulnerability...

CVE-2026-4610: Improper Neutralization of Input During Web Page Generation

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pmauthormessage' parameter in the pmsendmessagetoauthor function in all versions up to, and including, 5.9.9.2 due to insufficient input sanitization and output...

CVE-2026-8163: Undefined Security Weakness

The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statements, leading to a SQL Injection vulnerability exploitable by authenticated users with Subscriber-level access and above...

CVE-2026-9822: Undefined Security Weakness

The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, allowing authenticated users with Subscriber-level access to read other users' booking line items, enumerate active coupons, and read pricing data...

CVE-2026-10779: Missing Authorization

The Classified Listing – Classified ads & Business Directory plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.4.2. This is due to a missing capability/ownership check on the galleryimageupdateasfeature AJAX handler action:...

CVE-2026-9013: Missing Authorization

The Bogo plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the bogorestcreateposttranslation. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the raw title, content, excerpt,...

CVE-2026-54804: Authentication Bypass Using an Alternate Path or Channel

Subscriber Broken Authentication in Melhor Envio = 2.16.3 versions...

CVE-2026-45436: Missing Authorization

Subscriber Broken Access Control in WPBakery Page Builder = 8.7.2 versions...

CVE-2026-54805: Incorrect Privilege Assignment

Subscriber Privilege Escalation in Falang multilanguage = 1.4.2 versions...

CVE-2026-25446: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in WishList Member X = 3.29.0 versions...

CVE-2026-39546: Incorrect Privilege Assignment

Subscriber Privilege Escalation in MultiLoca = 4.2.15 versions...

CVE-2026-48967: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Geo Mashup = 1.13.19 versions...

CVE-2026-40749: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in Charity Zone = 1.1.1 versions...

CVE-2026-40748: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in Kids Gift Shop = 0.5.4 versions...

CVE-2026-40723: Missing Authorization

Subscriber Broken Access Control in Bricks Builder = 2.1.4 versions...

CVE-2026-39433: Missing Authorization

Subscriber Arbitrary Content Deletion in WPAMS 49.5.3 versions...

CVE-2026-24575: Missing Authorization

Subscriber Broken Access Control in WishList Member X = 3.29.0 versions...

CVE-2025-60218: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in PT Luxa Addons = 1.2.2 versions...

WordPress Plugin: wc-frontend-manager-ultimate: CVE-2026-22335: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate 6.7.7 versions...

CVE-2025-69135: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Events Schedule - WordPress Events Calendar Plugin = 2.7.2 versions...