CVE-2026-57749

CVE-2026-57749 is a Local File Inclusion vulnerability in the WordPress SportsPress Pro plugin, affecting versions up to and including 2.7.29. The issue is documented across multiple feeds (NVD, CVE List, CIRCL, AttackersKB, EUVD, etc.). The reported CVSS v3.1 metrics indicate a high overall impa...

EUVD-2026-41305

Contributor Local File Inclusion in SportsPress Pro = 2.7.29 versions...

CVE-2026-57746 WordPress Booked plugin <= 3.0.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in Booked = 3.0.0 versions...

CVE-2026-57747

CVE-2026-57747 is an unauthenticated CSRF vulnerability in the WordPress Booked plugin

CVE-2026-57747 WordPress Booked plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Booked = 3.0.0 versions...

CVE-2026-57731 WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability

Contributor Broken Access Control in Flatsome = 3.20.5 versions...

CVE-2026-57731 WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability

Contributor Broken Access Control in Flatsome = 3.20.5 versions...

CVE-2026-57730 WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability

Subscriber Broken Access Control in Flatsome = 3.20.5 versions...

CVE-2026-57687

CVE-2026-57687 concerns a SQL Injection vulnerability in the WordPress plugin Custom Field Template (versions

CVE-2026-57686

Unauthenticated Cross Site Scripting XSS in WowAddons = 1.6.14 versions...

EUVD-2026-41292

Unauthenticated SQL Injection in WP Fast Total Search = 1.80.280 versions...

CVE-2026-57682

Unauthenticated Cross Site Scripting XSS in Simple Link Directory = 15.0.5 versions...

CVE-2026-57682

The CVE-2026-57682 entry affects the WordPress plugin “Simple Link Directory” version ≤ 15.0.5, with an unauthenticated Cross Site Scripting (XSS) vulnerability. The connected records confirm the vulnerability type (XSS) and affected version, but do not provide concrete root-cause details, exploi...

CVE-2026-57682 WordPress Simple Link Directory plugin <= 15.0.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Simple Link Directory = 15.0.5 versions...

CVE-2026-57679

Unauthenticated SQL Injection in GeekyBot = 1.2.5 versions...

EUVD-2026-41286

Unauthenticated Cross Site Scripting XSS in WP Photo Album Plus = 9.2.02.004 versions...

CVE-2026-57671 WordPress perfmatters plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in perfmatters = 2.6.4 versions...

CVE-2026-57669 WordPress Advanced Contact form 7 DB plugin <= 2.0.9 - Broken Access Control vulnerability

Subscriber Broken Access Control in Advanced Contact form 7 DB = 2.0.9 versions...

CVE-2026-57623 WordPress W3 Total Cache plugin <= 2.9.4 - Arbitrary Code Execution vulnerability

Unauthenticated Arbitrary Code Execution in W3 Total Cache = 2.9.4 versions...

CVE-2026-57621

CVE-2026-57621 : Unauthenticated PHP Object Injection in the WordPress plugin Booktics (versions ≤ 1.0.21). Root cause as stated is PHP object injection in Booktics ≤ 1.0.21. CVSS 3.1 base score 9.8 (CRITICAL) with network attack vector, no user interaction, and impact to confidentiality, integri...