CVE-2026-65538

Author Cross Site Scripting XSS in Machete = 5.2 versions...

EUVD-2026-48134

Contributor Cross Site Scripting XSS in Smart SEO Tool = 4.1.2 versions...

EUVD-2026-48133

Shop manager SQL Injection in Persian Woocommerce SMS = 7.2.2 versions...

CVE-2026-65532

CVE-2026-65532 concerns the WordPress Persian Woocommerce SMS plugin, affected

EUVD-2026-48131

Subscriber Broken Access Control in TemplateSpare = 4.2.2 versions...

CVE-2026-65530

Subscriber Broken Access Control in TemplateSpare = 4.2.2 versions...

EUVD-2026-48120

Unauthenticated Server Side Request Forgery SSRF in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-65494

CVE-2026-65494 affects WordPress via the Dokan Pro plugin ≤ 5.0.2, with a Subscriber SQL Injection vulnerability. The connected data confirms the affected component and the vulnerability class (SQL injection) but does not provide exploit details, affected tables/parameters, or a patch/version to ...

CVE-2026-65490

Unauthenticated Sensitive Data Exposure in Create by Mediavine = 2.5.3 versions...

EUVD-2026-48096

Unauthenticated Broken Access Control in Content Control = 2.6.5 versions...

EUVD-2026-48089

Subscriber Broken Access Control in ListingPro = 2.9.10 versions...

EUVD-2026-48087

Unauthenticated Broken Access Control in Civi = 2.2.4 versions...

CVE-2026-65474

Unauthenticated Sensitive Data Exposure in Ninja Tables = 5.2.10 versions...

EUVD-2026-48078

Custom role Server Side Request Forgery SSRF in JetBooking = 4.1.2 versions...

CVE-2026-65466

CVE-2026-65466 concerns a Server Side Request Forgery (SSRF) in the WordPress JetBooking plugin <= 4.1.2 . The description specifies a custom role -driven SSRF vulnerability affecting JetBooking versions up to 4.1.2. The CVSSv3.1 metrics (source: Patchstack) indicate a network attack vector , ...

EUVD-2026-48222

Subscriber Broken Access Control in ЮKassa для WooCommerce = 2.16.1 versions...

CVE-2026-61948

WordPress WPDM – Premium Packages plugin ≤ 6.2.0 is affected by unauthenticated SQL injection. The vulnerability is documented in CVE-2026-61948 with a CVSS v3.1 base score of 9.3 (CRITICAL) and a network attack vector, no privileges required, no user interaction. Details indicate the issue is an...

CVE-2026-61943

CVE-2026-61943 describes an unauthenticated Broken Access Control in the WordPress WPDM – Premium Packages plugin, affected versions

EUVD-2026-48198

Unauthenticated Broken Authentication in miniOrange Discord Integration = 2.2.4 versions...

EUVD-2026-48186

Subscriber Cross Site Scripting XSS in Masteriyo - LMS = 2.3.0 versions...