EUVD-2026-80185

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-78474

The Ni WooCommerce Sales Report WordPress plugin (versions before 4.2.0 ) is vulnerable to unauthenticated data disclosure. The root cause is a lack of authentication or authorisation checks on one of its report-printing routines, specifically involving the 'btn_print' parameter. This allows unau...

CVE-2026-82124 Schema & Structured Data for WP & AMP < 1.66 - Unauthenticated Password-Protected Post Content Disclosure via JSON-LD Schema Output

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public...

CVE-2026-82125 Schema & Structured Data for WP & AMP 1.46 - 1.65 - Unauthenticated Non-Public Comment Content Disclosure via IDOR

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not correctly verify the ownership or the moderation status of a comment before returning its content, allowing unauthenticated users to read the content of comments still awaiting moderation or marked as spam...

CVE-2026-82126

The Schema & Structured Data for WP & AMP WordPress plugin (versions 1.63-1.65 ) is vulnerable to improper access control. The plugin fails to verify if a user has permission to edit a specific post when requesting schema generation. This allows users with the contributor role and above to obtain...

EUVD-2026-80186

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any authentication or authorisation checks on one of its report-printing routines, allowing unauthenticated users to retrieve WooCommerce order details and customer contact information, to target an individual order, and ...

EUVD-2026-80189

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the specific post they request schema generation for, allowing users with the contributor role and above to obtain the content of other users' draft, pending, private and password...

EUVD-2026-80184

The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge...

CVE-2026-76555 WP Import Export Lite < 3.9.33 - Authenticated Sensitive File Disclosure via Existing File Import Path Traversal

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allowing any user whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import...

EUVD-2026-80182

The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the...

CVE-2026-77702 Eventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_token

The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge...

CVE-2026-76556 WP Import Export Lite < 3.9.33 - Authenticated SQLi via Export Filter Rules

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission, which administrators have by default and may also grant to lower roles, to perform SQL...

EUVD-2026-80180

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission, which administrators have by default and may also grant to lower roles, to perform SQL...

CVE-2026-76556

The WP Import Export Lite WordPress plugin, in versions prior to 3.9.33 , is vulnerable to SQL injection due to the improper sanitization and escaping of certain export filter values before they are utilized in SQL statements. This flaw allows authenticated users with export permissions—which inc...

CVE-2026-76558 WP Import Export Lite < 3.9.33 - Contributor+ Stored DOM XSS via Custom Field Names

The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the...

CVE-2026-77702

The Eventin WordPress plugin (also known as WP Event Solution ) versions prior to 4.1.24 is vulnerable to an unauthenticated ticket price rewrite. The flaw exists because the plugin fails to prevent a guest's checkout token from being used to modify order tickets post-checkout. This allows an una...

CVE-2026-76559 WP Import Export Lite < 3.9.33 - Admin+ SSRF via Import URL Handling

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their...

EUVD-2026-80179

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allowing any user whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import...

CVE-2026-76557 WP Import Export Lite < 3.9.33 - Authenticated SQLi via Import Options

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission ...

EUVD-2026-80181

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission ...