WordPress 3D Flipbook PDF Viewer & Embedder plugin <= 1.4.2 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Nabil Irawan in WordPress Plugin 3D Flipbook PDF Viewer & Embedder versions = 1.4.2...

WordPress Paid Member Subscriptions plugin <= 3.0.7 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Paid Member Subscriptions versions = 3.0.7...

WordPress Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin <= 2.10.22 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce versions = 2.10.22...

CVE-2026-65539

The advisory concerns CVE-2026-65539: Unauthenticated CSRF in WordPress Kwayy HTML Sitemap plugin version

CVE-2026-65540

CVE-2026-65540 affects the WordPress plugin “Popup for CF7 with Sweet Alert” (versions &lt;= 1.6.5). The vulnerability is a reported unauthenticated Cross Site Request Forgery (CSRF) weakness in this plugin. The CVSS data indicate: AV:N, AC:L, PR:N, UI:R, S:C, C:L, I:L, A:L, base score 7.1 (HIGH)...

CVE-2026-65538

CVE-2026-65538 : WordPress Machete plugin ≤ 5.2 contains a Cross Site Scripting (XSS) vulnerability in the author context. The CVSS v3.1 base score is 5.9 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. The provided documents do not specify the exact vulnerable component, explo...

CVE-2026-65536

CVE-2026-65536 affects the WordPress WooCommerce shipping plugin (Persian: افزونه حمل و نقل ووکامرس) for fast/custom delivery and courier options,

CVE-2026-65537

CVE-2026-65537 concerns a WordPress plugin, Cyr to Lat reloaded – transliteration of links and file names , affected in versions

CVE-2026-65527

The CVE-2026-65527 entry covers a Cross Site Scripting (XSS) vulnerability in the WordPress LIQUID SPEECH BALLOON plugin, affected versions

CVE-2026-65524

Technical details for CVE-2026-65524 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-65521

Technical details are not publicly available in the provided documents. Monitor for updates on CVE-2026-65521.

CVE-2026-65518

The CVE concerns the WordPress plugin “Accept Donations with PayPal & Stripe” (v &lt;= 1.5.5) and reports a Cross Site Scripting (XSS) vulnerability. Affected product is the WordPress plugin; vulnerability arises from an XSS issue in versions up to 1.5.5 as described in the CVE records. Public re...

CVE-2026-65514

CVE-2026-65514 affects the WordPress plugin Appointment Hour Booking up to version 1.5.86, with a reported Cross Site Scripting (XSS) vulnerability. The CVSS 3.1 base score is 6.5 (Medium); attack vector is network, attack complexity low, privileges required low, and user interaction is required,...

CVE-2026-65505

CVE-2026-65505 concerns WordPress sites using the Ultimate Store Kit Elementor Addons plugin, affected versions

CVE-2026-65503 WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

CVE-2026-65501 WordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Shiptastic for WooCommerce = 5.1.0 versions...

CVE-2026-65501 WordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Shiptastic for WooCommerce = 5.1.0 versions...

CVE-2026-65501

CVE-2026-65501 affects the WordPress plugin Shiptastic for WooCommerce (versions

CVE-2026-65503

The CVE concerns WordPress plugin Ultimate Store Kit Elementor Addons versions

CVE-2026-65496

CVE-2026-65496 affects the WordPress Complianz plugin (versions ≤ 7.5.0). The description indicates an Author SSRF in Complianz ≤ 7.5.0. CVSSv3.1 base score 4.4 (Network attack, High complexity, Privileges Required: High, No user interaction; Confidentiality and Integrity Low, Availability None; ...