CVE-2026-78258

Unauthenticated Broken Access Control in Booking and Rental Manager = 2.7.5 versions...

CVE-2026-66610

Unauthenticated Cross Site Scripting XSS in Urna = 2.6.2 versions...

CVE-2026-66671

Unauthenticated Local File Inclusion in Verdure Core = 1.2 versions...

CVE-2026-66623

Unauthenticated Cross Site Scripting XSS in Social Media & Share Icons = 2.9.9 versions...

CVE-2026-66599

Unauthenticated Cross Site Scripting XSS in WPComplete = 2.9.5.6 versions...

CVE-2026-66584

Unauthenticated Cross Site Scripting XSS in 12 Step Meeting List = 3.19.16 versions...

CVE-2026-32551

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in DiviNext Woo Essential allows SQL Injection. This issue affects Woo Essential: from n/a through 4.3.0...

CVE-2026-28190

Subscriber Broken Access Control in ProLancer Element = 1.4.8 versions...

CVE-2026-32478

Subscriber SQL Injection in WP Project Manager Pro = 4.0.1 versions...

CVE-2026-28151

Unauthenticated Local File Inclusion in Tonda 2.6 versions...

CVE-2026-28165

Unauthenticated Privilege Escalation in Digits = 9.2 versions...

CVE-2026-28162

Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...

CVE-2026-28166

Unauthenticated Cross Site Scripting XSS in Tourmaster = 5.4.9 versions...

WordPress AllCoach plugin < 1.0.2 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Pedro Pinho in WordPress Plugin AllCoach versions 1.0.2...

CVE-2026-66650

CVE-2026-66650 is an unauthenticated PHP Object Injection vulnerability in the WordPress theme FreightCo , affecting versions ≤ 1.1.15 . Discovered by daroo , it allows a remote, unauthenticated attacker to achieve full compromise (confidentiality, integrity, and availability), rated CVSS 9.8 (CR...

EUVD-2026-64808

Unauthenticated Privilege Escalation in Jawn = 1.4.2 versions...

EUVD-2026-64803

Unauthenticated SQL Injection in Woo Essential = 4.3.0 versions...

EUVD-2026-64801

Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons = 2.2.0 versions...

CVE-2026-32478 WordPress WP Project Manager Pro plugin <= 4.0.1 - SQL Injection vulnerability

Subscriber SQL Injection in WP Project Manager Pro = 4.0.1 versions...

CVE-2026-32478

CVE-2026-32478 is a Subscriber-level SQL Injection vulnerability in the WP Project Manager Pro WordPress plugin (versions ≤ 4.0.1 ), discovered by researcher dutafi . The flaw allows a user with the low-privilege Subscriber role to execute arbitrary SQL queries, resulting in high confidentiality ...