CVE-2026-81740: Improper Authentication

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation, allowing unauthenticated attackers to change the status of...

WordPress MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin <= 5.0.18 - Authenticated (Store Manager+) SQL Injection vulnerability

Authenticated Store Manager+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin MultiVendorX versions = 5.0.18...

WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Intrudify in WordPress Plugin Ultimate Member versions = 2.13.1...

WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Ultimate Member versions = 2.13.1...

WordPress Pie Register plugin <= 3.8.4.13 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Pie Register versions = 3.8.4.13...

WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin ElementsKit Elementor addons Lite versions = 4.0.6...

WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nixxies in WordPress Plugin AFFI – Affiliate Marketing for WooCommerce versions = 1.0.9...

WordPress Majestic Support plugin <= 1.2.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Peter Tang in WordPress Plugin Majestic Support versions = 1.2.0...

WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by V1T in WordPress Plugin Photo Reviews for WooCommerce versions = 1.2.30...

WordPress PDF Invoices & Packing Slips for WooCommerce plugin <= 5.16.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin WooCommerce PDF Invoices & Packing Slips versions = 5.16.1...

WordPress Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Calculated Fields Form versions = 5.5.1.3...

WordPress Autoptimize plugin <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by lhking in WordPress Plugin Autoptimize versions = 3.1.15.1...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by hashiramasenju333 in WordPress Plugin LatePoint versions = 5.7.0...

WordPress ClearSale Total plugin <= 3.4.2 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Catalin Oancea 0x4D5A in WordPress Plugin ClearSale Total versions = 3.4.2...

WordPress Super Forms – Drag & Drop Form Builder plugin <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion vulnerability

Authenticated Subscriber+ Arbitrary File/Directory Deletion vulnerability discovered by d.v4ns3c in WordPress Plugin Super Forms versions = 6.3.316...

CVE-2026-86610

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's...

CVE-2026-81809

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to perfor...

CVE-2026-96200

The Payments for Hubtel WordPress plugin (versions before 1.0.2 ) is vulnerable to an Unauthenticated Payment Confirmation Forgery . The root cause is a failure to verify that payment notifications received via the plugin's payment callback actually originate from the legitimate payment provider....

CVE-2026-92412 Five Star Restaurant Reviews < 2.3.14 - Reflected XSS

The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before outputting it into an HTML tag, allowing unauthenticated attackers to inject arbitrary web script that runs in the browser of anyone tricked into submitting a crafted request,...

CVE-2026-90974 WP Fusion Lite 3.37.14 - 3.47.14 - Unauthenticated CRM Integration Settings Update

The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an...