CVE-2026-59559 WordPress RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg = 1.5.1 versions...

CVE-2026-59557

CVE-2026-59557 relates to the WordPress Events Made Easy plugin, affected versions

CVE-2026-59557 WordPress Events Made Easy plugin <= 3.1.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Events Made Easy = 3.1.3 versions...

CVE-2026-59556

Unauthenticated Cross Site Scripting XSS in Dynamic Pricing With Discount Rules for WooCommerce = 4.5.11 versions...

EUVD-2026-49223

Unauthenticated Cross Site Scripting XSS in Dynamic Pricing With Discount Rules for WooCommerce = 4.5.11 versions...

EUVD-2026-49221

Unauthenticated Server Side Request Forgery SSRF in 3D Flipbook PDF Viewer & Embedder = 1.4.2 versions...

CVE-2026-59552

Unauthenticated Server Side Request Forgery SSRF in 3D Flipbook PDF Viewer & Embedder = 1.4.2 versions...

CVE-2026-59551

The CVE-2026-59551 entry concerns the WordPress plugin rtMedia for WordPress, BuddyPress and bbPress (versions up to 4.7.10). The issue is a SQL Injection vulnerability in subscriber handling within this plugin. Public details in the provided documents specify affected software and the underlying...

CVE-2026-59551

Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...

CVE-2026-59551 WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability

Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...

CVE-2026-59550 WordPress AWP Classifieds plugin <= 4.4.7 - SQL Injection vulnerability

Unauthenticated SQL Injection in AWP Classifieds = 4.4.7 versions...

EUVD-2026-49217

Unauthenticated Sensitive Data Exposure in Byteflows Travel & Hotel Booking = 1.0.0 versions...

CVE-2026-59548

Unauthenticated Sensitive Data Exposure in Byteflows Travel & Hotel Booking = 1.0.0 versions...

EUVD-2026-49216

Subscriber Broken Authentication in Hide My WP Ghost = 7.0.06 versions...

CVE-2026-59539

Subscriber Insecure Direct Object References IDOR in Paid Member Subscriptions = 3.0.7 versions...

EUVD-2026-49213

Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce = 2.10.22 versions...

CVE-2026-59537

The CVE concerns the WordPress plugin Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce (

CVE-2026-59537 WordPress Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin <= 2.10.22 - SQL Injection vulnerability

Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce = 2.10.22 versions...

CVE-2026-59536 WordPress CoCart – Headless ecommerce plugin <= 4.8.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in CoCart – Headless ecommerce = 4.8.4 versions...

CVE-2026-59535

CVE-2026-59535 affects WordPress Thrive Product Manager plugin