WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Intrudify in WordPress Plugin Ultimate Member versions = 2.13.1...

WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Ultimate Member versions = 2.13.1...

WordPress Pie Register plugin <= 3.8.4.13 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Pie Register versions = 3.8.4.13...

WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin ElementsKit Elementor addons Lite versions = 4.0.6...

WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nixxies in WordPress Plugin AFFI – Affiliate Marketing for WooCommerce versions = 1.0.9...

WordPress Majestic Support plugin <= 1.2.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Peter Tang in WordPress Plugin Majestic Support versions = 1.2.0...

WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by V1T in WordPress Plugin Photo Reviews for WooCommerce versions = 1.2.30...

WordPress PDF Invoices & Packing Slips for WooCommerce plugin <= 5.16.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin WooCommerce PDF Invoices & Packing Slips versions = 5.16.1...

WordPress Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Calculated Fields Form versions = 5.5.1.3...

WordPress Autoptimize plugin <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by lhking in WordPress Plugin Autoptimize versions = 3.1.15.1...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by hashiramasenju333 in WordPress Plugin LatePoint versions = 5.7.0...

WordPress ClearSale Total plugin <= 3.4.2 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Catalin Oancea 0x4D5A in WordPress Plugin ClearSale Total versions = 3.4.2...

WordPress Super Forms – Drag & Drop Form Builder plugin <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion vulnerability

Authenticated Subscriber+ Arbitrary File/Directory Deletion vulnerability discovered by d.v4ns3c in WordPress Plugin Super Forms versions = 6.3.316...

CVE-2026-86610

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's...

CVE-2026-81809

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to perfor...

CVE-2026-92412 Five Star Restaurant Reviews < 2.3.14 - Reflected XSS

The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before outputting it into an HTML tag, allowing unauthenticated attackers to inject arbitrary web script that runs in the browser of anyone tricked into submitting a crafted request,...

CVE-2026-90974 WP Fusion Lite 3.37.14 - 3.47.14 - Unauthenticated CRM Integration Settings Update

The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an...

WordPress Payments for Hubtel plugin < 1.0.2 - Unauthenticated Order Key Disclosure vulnerability

Unauthenticated Order Key Disclosure vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Payments for Hubtel versions 1.0.2...

CVE-2026-90974

The WP Fusion Lite WordPress plugin (versions before 3.48.0 ) contains a vulnerability where a settings handler running during admin initialization does not require authentication. This allows unauthenticated users to overwrite the site's CRM integration endpoint and credentials. Once modified, s...

CVE-2026-90972 WP Fusion Lite < 3.48.0 - Subscriber+ User Email Disclosure and Cross-User CRM Data Deletion

The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync...