WordPress CoCart – Headless ecommerce plugin <= 4.8.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by VanTastic in WordPress Plugin CoCart – Headless ecommerce versions = 4.8.4...

WordPress Thrive Product Manager plugin <= 10.9.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Austin Ginder in WordPress Plugin Thrive Product Manager versions = 10.9.2...

CVE-2026-65550

Shop Manager Cross Site Scripting XSS in Tabs = 2.5 versions...

EUVD-2026-48141

Unauthenticated Cross Site Request Forgery CSRF in Popup for CF7 with Sweet Alert = 1.6.5 versions...

EUVD-2026-48138

Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names = 1.3.3 versions...

EUVD-2026-48137

Unauthenticated Cross Site Request Forgery CSRF in افزونه حمل و نقل ووکامرس پست پیشتاز و سفارشی، پیک موتوری = 4.4.5 versions...

CVE-2026-65537

Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names = 1.3.3 versions...

CVE-2026-65536

CVE-2026-65536 affects the WordPress WooCommerce shipping plugin (Persian: افزونه حمل و نقل ووکامرس) for fast/custom delivery and courier options,

CVE-2026-65537

CVE-2026-65537 concerns a WordPress plugin, Cyr to Lat reloaded – transliteration of links and file names , affected in versions

CVE-2026-65535

Contributor Sensitive Data Exposure in TinyMCE Templates = 4.8.1 versions...

EUVD-2026-48136

Contributor Sensitive Data Exposure in TinyMCE Templates = 4.8.1 versions...

EUVD-2026-48135

Author Cross Site Scripting XSS in Custom links in Elementor Image Carousel = 1.1.1 versions...

CVE-2026-65531

Unauthenticated Broken Access Control in Qubely = 1.8.14 versions...

EUVD-2026-48133

Shop manager SQL Injection in Persian Woocommerce SMS = 7.2.2 versions...

CVE-2026-65531 WordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Qubely = 1.8.14 versions...

CVE-2026-65532 WordPress Persian Woocommerce SMS plugin <= 7.2.2 - SQL Injection vulnerability

Shop manager SQL Injection in Persian Woocommerce SMS = 7.2.2 versions...

CVE-2026-65532

CVE-2026-65532 concerns the WordPress Persian Woocommerce SMS plugin, affected

EUVD-2026-48131

Subscriber Broken Access Control in TemplateSpare = 4.2.2 versions...

CVE-2026-65530

Subscriber Broken Access Control in TemplateSpare = 4.2.2 versions...

CVE-2026-65529

Unauthenticated Broken Access Control in Graphina = 3.1.12 versions...