CVE-2026-14840

CVE-2026-14840 concerns the YOP Poll WordPress plugin (before 7.0.6). The vulnerability arises because the plugin does not validate the connection’s origin IP and trusts client-controlled forwarding headers when enforcing per-IP vote limits, enabling unauthenticated attackers to bypass the vote r...

EUVD-2026-51712

The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypass the vote limit and cast unlimited votes on a public poll...

EUVD-2026-51711

The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished draft, pending, private, and...

CVE-2026-14315

The Pixel Tag Manager for WooCommerce WordPress plugin is vulnerable in versions before 2.2.1: an AJAX action lacks authorization, letting unauthenticated users forge e‑commerce conversion events via the site’s configured server‑side advertising conversion APIs using stored credentials. Impact is...

CVE-2026-14561

The Authora WordPress plugin (before version 1.7.7) fails to keep its one‑time login code confidential, exposing both the code and a valid verification token in the response of an unauthenticated action. This enables unauthenticated attackers to log in as any user whose registered mobile number i...

CVE-2026-14822

CVE-2026-14822 affects the WordPress plugin “Event Tickets and Registration” (before 5.29.0.1). The vulnerability is an missing authorization check on an order-management REST endpoint, allowing unauthenticated users to alter the status of existing orders. The underlying root cause is lack of acc...

CVE-2026-14315

The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.1 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to submit forged e-commerce conversion events to the site's configured server-side advertising conversion APIs using the site's...

CVE-2026-14561

The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered...

CVE-2026-14822

The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders...

EUVD-2026-51707

The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.1 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to submit forged e-commerce conversion events to the site's configured server-side advertising conversion APIs using the site's...

EUVD-2026-51708

The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered...

CVE-2026-13596

The CVE pertains to the WordPress plugin Participants Database, affected version prior to 2.7.8.4. The issue is improper sanitization/escaping of a user-supplied parameter used in an SQL query, enabling unauthenticated SQL injection. Impact is unauthenticated data access or manipulation via the v...

CVE-2026-13604

CVE-2026-13604 affects the Pixelavo WordPress plugin (pre-1.5.4). The vulnerability is an unauthenticated AJAX action, gated only by a nonce emitted on every front-end page, that forwards client-supplied event data to the Facebook Conversions API using the administrator’s stored access token. Thi...

CVE-2026-13725

The vulnerability CVE-2026-13725 affects the Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin prior to 5.0.0. The issue arises because a nonce and user capability validation is not performed on one AJAX action, and the response reflects unsanitised user input, enabling unauthe...

CVE-2026-13604

The Pixelavo WordPress plugin before 1.5.4 registers an unauthenticated AJAX action, gated only by a nonce that it emits publicly on every front-end page, that forwards client-supplied event data to the configured Facebook Conversions API using the administrator's stored access token. This allows...

CVE-2026-13725

The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against...

CVE-2026-13596

The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks...

EUVD-2026-51701

The Pixelavo WordPress plugin before 1.5.4 registers an unauthenticated AJAX action, gated only by a nonce that it emits publicly on every front-end page, that forwards client-supplied event data to the configured Facebook Conversions API using the administrator's stored access token. This allows...

EUVD-2026-51700

The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks...

EUVD-2026-51702

The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against...