CVE-2026-87896

The Rox Appointment Booking WordPress plugin before version 1.2.8 has a missing authorization check on its agent REST route , which returns booking staff records. This allows unauthenticated attackers to read sensitive information for every staff member, including email addresses, phone numbers, ...

EUVD-2026-80213

The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board media, allowing unauthenticated attackers to permanently delete its uploaded media files and their database records by iterating identifiers...

CVE-2026-88910

kboard is a WordPress plugin that, in versions before 6.7 , fails to verify ownership or context before deleting board media. This IDOR flaw allows unauthenticated attackers to permanently delete uploaded media files and their associated database records simply by iterating identifiers. The vulne...

EUVD-2026-80210

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent staff records, allowing unauthenticated attackers to read staff email addresses, phone numbers, private internal notes and the linked WordPress account nam...

CVE-2026-87907

The Rox Appointment Booking WordPress plugin prior to version 1.2.8 fails to perform an authorization check on the REST endpoints that return booking service and category records. This allows unauthenticated attackers to read private internal notes stored on each service and category, constitutin...

EUVD-2026-80211

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category...

CVE-2026-87854

Subscriptions for WooCommerce WordPress plugin versions before 2.0.3 fail to correctly validate the shared secret protecting one of its REST endpoints. This allows unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amou...

EUVD-2026-80206

The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthenticated attackers to redirect users to arbitrary external sites and to disclose a subscriber token that grants access to that subscriber...

CVE-2026-86823

The Newsletter WordPress plugin before 9.3.7 fails to validate the redirect destination after a public subscription action, triggered via the ncu parameter. This flaw enables unauthenticated attackers to perform an open redirect to arbitrary external sites and to disclose a subscriber token , whi...

CVE-2026-86448

The LearnPress WordPress plugin before 4.4.7 is vulnerable to unauthenticated order data disclosure via the lp_download_order function. The plugin does not perform any authentication, capability, or nonce check before serving a previously generated order export file. An unauthenticated attacker w...

EUVD-2026-80201

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowing unauthenticated attackers to retrieve the text, identifier and type of every published quiz question on the site, along with a keyword search over them, whi...

EUVD-2026-80202

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unauthenticated attackers to list every enrolled student's display name and user identifier against the course they are enrolled on, and to recover their email...

CVE-2026-86447

The LearnPress WordPress plugin before 4.4.7 fails to verify user capabilities in its administrative course tool, specifically the load_content_via_ajax handler. This missing authorization check allows unauthenticated attackers to enumerate every enrolled student's display name and user identifie...

EUVD-2026-80204

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed one...

CVE-2026-86449

The LearnPress WordPress plugin (before 4.4.7 ) contains a missing capability check in one of its REST routes. An unauthenticated attacker can supply a custom post status filter to list courses that are not published, including those in draft, pending, private, scheduled, and trashed states. The ...

CVE-2026-86445

LearnPress WordPress plugin versions before 4.4.7 contain a missing capability check in the administrative template handler load_content_via_ajax. This allows unauthenticated attackers to retrieve the text, identifier, and type of every published quiz question on the site, as well as perform a ke...

CVE-2026-86444

LearnPress is a WordPress plugin vulnerable to reflected XSS before version 4.4.7. The root cause is an unescaped user-supplied value (the 'skin' parameter ) used in an HTML attribute on a public page. An unauthenticated attacker can craft a link that, when opened, executes arbitrary JavaScript i...

EUVD-2026-80200

The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only...

EUVD-2026-80199

The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in th...

CVE-2026-85641

Formidable Forms WordPress plugin (versions before 6.35 ) contains an unauthenticated stored content injection vulnerability. The root cause is that the plugin does not restrict who can set the updated_by parameter, which records the user who last edited a form entry. Because the plugin relies on...