EUVD-2026-52601

The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extension, content, or size of files submitted to its public response endpoint and stores them under the uploads directory, so an...

CVE-2026-16547

CVE-2026-16547 affects the WordPress REST API Log plugin prior to 1.7.1. The log download endpoint does not bind the token to the requested log entry nor verify requester capabilities, allowing unauthenticated users possessing a valid token to download REST API request/response logs that may incl...

CVE-2026-16548

CVE-2026-16548 affects the WordPress plugin “The Chat Widget: Floating Customer Support Button for 30+ Channels” prior to version 1.8.2. An unauthenticated user can upload arbitrary files via the public response endpoint because the plugin does not validate file type, extension, content, or size,...

EUVD-2026-52600

The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests a...

CVE-2026-16069

CVE-2026-16069 affects the Brizy WordPress plugin (pre-2.8.19). The vulnerability stems from unsanitized/uncached featured-image focal-point coordinates submitted via an AJAX action, which are stored and later echoed into HTML attributes in the post editor’s Featured Image meta box. This enables ...

CVE-2026-16295

Technical details about this CVE are not publicly available in the provided documents. Monitor for updates.

CVE-2026-16296

Technical details for CVE-2026-16296 are not publicly available in the provided documents; monitoring for updates is advised.

EUVD-2026-52596

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Podcast Episode settings, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...

EUVD-2026-52598

The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-defaul...

EUVD-2026-52595

The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request parameter that is different from the one used in the write operation, allowing users with Contributor-level access and above to...

EUVD-2026-52594

The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box, allowing users with the Contributor...

CVE-2026-16293

CVE-2026-16293 affects the Blubrry PowerPress WordPress plugin prior to version 11.16.11. The issue is a Stored XSS in Podcast Episode settings due to insufficient sanitisation/escaping, allowing low-privilege users (Contributor) to inject scripts even when unfiltered_html is disallowed. Vulnerab...

CVE-2026-16070

Brizy WordPress plugin prior to 2.8.19 is affected by an authorization issue (IDOR) in template-type updates. The plugin does not properly verify authorization on the object being modified, validating a request parameter different from the one used in the write operation, enabling users with Cont...

EUVD-2026-52599

The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJAX actions, and does not verify that the RSVP being removed belongs to the requesting user, allowing users with a role as low as Subscriber to remove arbitrary users' RSVPs from...

CVE-2026-16068

The Brizy WordPress plugin vulnerable to stored XSS (CVE-2026-16068) affects versions before 2.8.19. Authenticated users with Author-level access or higher can modify site-global design data and, due to incomplete sanitisation, store arbitrary JavaScript that is served unsanitised on front-end pa...

CVE-2026-16035

The CVE concerns the miniOrange 2FA WordPress plugin prior to version 6.2.7. It allows a low-privilege user to trigger OTP sends to arbitrary recipients and to bind OTP delivery to the enrolling user’s address is not enforced, enabling misuse to email one-time-passcodes to unintended recipients a...

EUVD-2026-52590

The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the...

EUVD-2026-52591

The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user's own address, allowing a low-privileged user to send one-time-passcode emails to arbitrary recipients and to exhaust the...

CVE-2026-16056

The CVE concerns the Contest Gallery WordPress plugin prior to version 30.0.7, where a handler fails to enforce capability/nonce checks, allowing any authenticated user down to the Subscriber role to read the site’s entire stored OpenAI prompt history. Affected component: Contest Gallery plugin f...

EUVD-2026-52593

The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitise...