CVE-2026-13400

CVE-2026-13400 affects the WordPress plugin Simply Schedule Appointments (all versions up to 1.6.12.2). The root cause is a sanitization-ordering defect: rendered notification content is decoded back into live HTML after passing through the plugin before 1.6.12.4’s wp_kses_post() filter, allowing...

CVE-2026-13714

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all...

CVE-2026-13597

The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the...

CVE-2026-13400

Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply...

CVE-2026-13597

CVE-2026-13597 affects the WordPress plugin for 微信二维码登陆 (QR code login) versions

EUVD-2026-49074

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all...

EUVD-2026-49073

The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the...

CVE-2026-13390 The Events Calendar < 6.16.5.1 - Unauthenticated Event Aggregator Import Status Manipulation

The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing import records as failed and to store...

CVE-2026-12982 Document Gallery < 5.1.1 - Reflected XSS via dg_generate_gallery

The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against unauthenticated users...

CVE-2026-12493 Clover Payment Gateway by Zaytech for WooCommerce < 1.3.6 - Unauthenticated Payment Bypass via check_order

The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooCommerce order being completed, nor that the paid amount matches the order total, allowing unauthenticated users to mark arbitrar...

CVE-2026-13152

The CVE concerns the Custom Fields Account Registration For WooCommerce WordPress plugin, pre-1.4. The issue allows an unauthenticated user who registers an account to gain administrator privileges by writing to the user capabilities meta key on sites using a non-default database table prefix, if...

CVE-2026-13332

Summary (CVE-2026-13332): The Masteriyo LMS WordPress plugin before 2.3.1 permits an unauthenticated user to trigger an AJAX action that clears user sessions without proper authorization checks. This leads to potential force-logout of any user’s active session, including administrators, by unauth...

CVE-2026-12493

The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin is affected up to version 1.3.6. The vulnerability stems from insufficient verification of external payment records: an approved payment may not be tied to the correct WooCommerce order, and the paid amount may not be validate...

CVE-2026-12982

The Document Gallery WordPress plugin (before 5.1.1) is affected by a Reflected XSS in an unauthenticated AJAX action (dg_generate_gallery) caused by improper sanitisation/escaping of user input. Impact is XSS for unauthenticated users; remediation is to update to 5.1.1 or later (as stated in CVE...

CVE-2026-13390

CVE-2026-13390 affects the WordPress plugin The Events Calendar (pre-6.16.5.1). The issue is an missing authorization check on an Event Aggregator import REST API route and an integrity check bypass for a specific status, enabling unauthenticated attackers to mark import records as failed and to ...

CVE-2026-13332 Masteriyo LMS < 2.3.1 - Unauthenticated Arbitrary User Session Termination (Denial of Service)

The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions force-logout of any user on the site, including administrators...

CVE-2026-13152 Custom Fields Account Registration For WooCommerce < 1.4 - Unauthenticated Privilege Escalation

The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table prefix, so an unauthenticated user who registers an account can be grant...

CVE-2026-12493

The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooCommerce order being completed, nor that the paid amount matches the order total, allowing unauthenticated users to mark arbitrar...

CVE-2026-12982

The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against unauthenticated users...

CVE-2026-13332

The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions force-logout of any user on the site, including administrators...