EUVD-2026-124978

The Newsletters plugin for WordPress is vulnerable to blind SQL Injection via the 'useremail' parameter in all versions up to, and including, 4.18.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-122063

The Newsletters plugin for WordPress is vulnerable to blind SQL Injection in all versions up to and including 4.18.2 . The root cause is insufficient escaping of the user_email parameter combined with a lack of proper preparation in the existing SQL query. Authenticated attackers with Subscriber-...

CVE-2026-92797 Memberpress <= 1.14.1 - Cross-Site Request Forgery via 'user_email' Parameter

The MemberPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.14.1. This is due to a bypassable nonce verification check in the saveprofilefields function that uses an isset condition at line 1119, allowing the security check to be completely...

CVE-2026-92797 Memberpress <= 1.14.1 - Cross-Site Request Forgery via 'user_email' Parameter

The MemberPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.14.1. This is due to a bypassable nonce verification check in the saveprofilefields function that uses an isset condition at line 1119, allowing the security check to be completely...

CVE-2026-92797

The MemberPress plugin for WordPress (versions up to and including 1.14.1 ) is vulnerable to Cross-Site Request Forgery (CSRF) . The root cause is a bypassable nonce verification check within the save_profile_fields() function; specifically, using an isset() condition at line 1119 allows attacker...

CVE-2026-109198

The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 6.89.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-109198 Anti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Stored Cross-Site Scripting via 'user_email' Registration Parameter

The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 6.89.1 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-108584

The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 6.89.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-109198 Anti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Stored Cross-Site Scripting via 'user_email' Registration Parameter

The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 6.89.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-109198

The Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 6.89.1 . The root cause is insufficient input sanitization and output escaping of the user_email parameter. An unauthenticated attacker can inject arbitrary web s...

WordPress CleanTalk Anti cross-site scripting vulnerability

WordPress CleanTalk Anti versions 6.89.1 and earlier contain a cross-site scripting vulnerability. This flaw stems from insufficient input sanitization and output escaping; it results in stored cross-site scripting via the ‘useremail’ parameter. Unauthenticated attackers can inject arbitrary web...

CVE-2026-107744: Missing Authorization

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.10 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible...

CVE-2026-75962

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and...

CVE-2026-75962

The Post SMTP WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 4.0.1 . The root cause is insufficient input sanitization and output escaping regarding the 'user_email' parameter. Attackers can bypass the plugin's validator by using numeric HT...

CVE-2026-75962 Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log)

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and...

EUVD-2026-92961

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and...

CVE-2026-75962 Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log)

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and...

CVE-2026-75962: Improper Neutralization of Input During Web Page Generation

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and...

CVE-2026-100371

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an authorization guard to Users::changepassword, was added to address a previous authorization flaw that allowed a secondary administrator usertype=1, userid != 1 to directly chan...

EUVD-2026-88481

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an authorization guard to Users::changepassword, was added to address a previous authorization flaw that allowed a secondary administrator usertype=1, userid != 1 to directly chan...