CVE-2026-15142: Improper Privilege Management

The Real Estate Manager Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 12.8.6. This is due to improper capability handling in the allowattachmentactions function, which can treat a target user ID as a media attachment ID during user capability...

CVE-2026-14279: Improper Privilege Management

The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the cedwholesalerequestsend AJAX action. The cedwholesalerequestsendcallback handler only verifies a nonce which is exposed to any authenticated user through wplocalizescrip...

CVE-2026-15993: Improper Neutralization of Special Elements used in an SQL Command

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via 'username' Placeholder in Dynamic-Choice Field WHERE Clause in all versions up to, and including, 1.15.44 due to insufficient escaping on the user supplied...

CVE-2026-66430

Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.10 versions...

CVE-2026-66654 WordPress Vehica Core plugin <= 1.0.104 - Server Side Request Forgery (SSRF) vulnerability

Subscriber Server Side Request Forgery SSRF in Vehica Core = 1.0.104 versions...

CVE-2026-66430: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.10 versions...

CVE-2026-66661: Incorrect Privilege Assignment

Subscriber Privilege Escalation in Directories Pro = 2.0.5 versions...

CVE-2026-66446: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in If-So Dynamic Content Personalization = 1.10 versions...

CVE-2026-28184: Undefined Security Weakness

Subscriber SQL Injection in Form Maker by 10Web = 1.15.44 versions...

CVE-2026-28181: Missing Authorization

Subscriber Broken Access Control in AcyMailing SMTP Newsletter = 10.11.1 versions...

CVE-2026-28157: Path Traversal: '.../...//'

Subscriber Path Traversal in Do Lasso = 358 versions...

CVE-2026-28186: Missing Authorization

Subscriber Broken Access Control in Travelfic Toolkit = 1.5.1 versions...

CVE-2026-66654: Server-Side Request Forgery (SSRF)

Subscriber Server Side Request Forgery SSRF in Vehica Core = 1.0.104 versions...

CVE-2026-28159: Missing Authorization

Subscriber Broken Access Control in Service Finder Booking = 6.2 versions...

CVE-2026-65582: Improper Limitation of a Pathname to a Restricted Directory

Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...

CVE-2026-66693: Missing Authorization

Subscriber Broken Access Control in Motors = 1.4.113 versions...

CVE-2026-28161: Incorrect Privilege Assignment

Subscriber Privilege Escalation in Service Finder Booking = 6.2 versions...

CVE-2026-28156: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Do Lasso = 358 versions...

CVE-2026-18943: Exposure of Sensitive Information to an Unauthorized Actor

The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscriber to read arbitrary user, post and term metadata, including data belonging to administrators...

CVE-2026-18962: Authorization Bypass Through User-Controlled Key

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the...