CVE-2026-81402

The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability check, nonce verification, or file-type validation on its image upload handler, allowing unauthenticated attackers to upload arbitrary files, including PHP, to a web-accessible directory, which can lead to remote code...

CVE-2026-77705

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the...

CVE-2026-77005

The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file path before deleting a file, and does not check the capability of the user making the request, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can...

CVE-2026-77689

The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway...

CVE-2026-75800

The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, allowing unauthenticated attackers to log in as any user, including administrators, as well as to create arbitrary accounts...

EUVD-2026-76806

The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers, allowing unauthenticated attackers to make those third-party API calls, and consume the associated cost, using the site's own...

CVE-2026-87894 Rox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Customer PII Disclosure via IDOR

The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email...

EUVD-2026-76803

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...

CVE-2026-87916

The WPBot WordPress plugin (versions before 8.6.0 ) is vulnerable to an unauthenticated Personally Identifiable Information (PII) disclosure . The root cause is a missing capability or nonce check on the AJAX action used to list stored chat sessions. An unauthenticated attacker can exploit this b...

CVE-2026-87892 Rox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...

CVE-2026-87894 Rox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Customer PII Disclosure via IDOR

The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email...

CVE-2026-87892

The Rox Appointment Booking WordPress plugin, in versions before 1.2.0 , contains a vulnerability where it fails to verify the order total or selected payment method against its own server-side pricing during booking creation. This allows unauthenticated attackers to create confirmed bookings at ...

EUVD-2026-76804

The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email...

CVE-2026-87918 WPBot < 8.5.7 - Unauthenticated AI Provider API Abuse via Multiple AJAX Actions

The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers, allowing unauthenticated attackers to make those third-party API calls, and consume the associated cost, using the site's own...

CVE-2026-87894

The Rox Appointment Booking WordPress plugin (versions 1.0.9-1.2.2 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to perform authorization checks on the endpoint responsible for returning booking confirmation details. Because bookings are accessed using seque...

CVE-2026-87916 WPBot 8.4.9 - 8.5.9 - Unauthenticated Chat Visitor PII Disclosure

The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, allowing unauthenticated attackers to retrieve the name, email address and phone number of every chat visitor by requesting a wide date range...

CVE-2026-87918

The WPBot WordPress plugin, in versions prior to 8.5.7 , is vulnerable to an improper access control issue. The plugin fails to perform necessary authorization or nonce checks on multiple AJAX actions used to relay prompts to configured AI providers. This allows unauthenticated attackers to trigg...

WordPress Product XML Feed Manager for WooCommerce plugin < 3.1.1 - Contributor+ Arbitrary Product Deletion vulnerability

Contributor+ Arbitrary Product Deletion vulnerability discovered by Abdullah Kareem cyberkareem in WordPress Plugin Product XML Feed Manager for WooCommerce versions 3.1.1...

WordPress WPBot plugin < 8.5.7 - Unauthenticated AI Provider API Abuse vulnerability

Unauthenticated AI Provider API Abuse vulnerability discovered by Pedro Pinho in WordPress Plugin ChatBot versions 8.5.7...

CVE-2026-87892 Rox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...