WordPress Gutenverse News plugin < 3.3.3 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Artus KG in WordPress Plugin Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons versions 3.3.3...

WordPress Advanced Customized Prompts plugin <= 1.0.1 - Subscriber+ Stored XSS vulnerability

Subscriber+ Stored XSS vulnerability discovered by 0xBassia in WordPress Plugin Advanced Customized Prompts versions = 1.0.1...

WordPress MultiVendorX plugin 5.0.0-5.0.15 - Store Owner+ Privilege Escalation to Administrator vulnerability

Store Owner+ Privilege Escalation to Administrator vulnerability discovered by Philipp Doblhofer in WordPress Plugin MultiVendorX versions 5.0.0-5.0.15...

WordPress WPCafe plugin 3.0.10-3.0.17 - Unauthenticated Order Disclosure and Modification vulnerability

Unauthenticated Order Disclosure and Modification vulnerability discovered by Artus KG in WordPress Plugin WPCafe versions 3.0.10-3.0.17...

WordPress Persian Elementor plugin 2.7.10-2.8.1 - Unauthenticated ZarinPal Payment Callback Authority Bypass vulnerability

Unauthenticated ZarinPal Payment Callback Authority Bypass vulnerability discovered by Artus KG in WordPress Plugin المنتور فارسی versions 2.7.10-2.8.1...

WordPress miniOrange 2FA plugin 18.0-19.2 - Unauthenticated Arbitrary Option Deletion vulnerability

Unauthenticated Arbitrary Option Deletion vulnerability discovered by Osman Hussein in WordPress Plugin miniOrange's Google Authenticator versions 18.0-19.2...

WordPress miniOrange 2FA plugin 5.3.24-6.3.0 - Unauthenticated Arbitrary Option Deletion vulnerability

Unauthenticated Arbitrary Option Deletion vulnerability discovered by Osman Hussein in WordPress Plugin miniOrange's Google Authenticator versions 5.3.24-6.3.0...

WordPress Teddy Bear Customize Addon plugin <= 1.0.5 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by 0xBassia in WordPress Plugin Teddy Bear Customize Addon versions = 1.0.5...

WordPress Teddy Bear Customize Addon plugin <= 1.0.5 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by 0xBassia in WordPress Plugin Teddy Bear Customize Addon versions = 1.0.5...

WordPress Advanced Customized Prompts plugin <= 1.0.1 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by 0xBassia in WordPress Plugin Advanced Customized Prompts versions = 1.0.1...

WordPress miniOrange 2FA plugin 18.0-19.2 - 2FA Bypass vulnerability

2FA Bypass vulnerability discovered by pervinzahidli in WordPress Plugin miniOrange's Google Authenticator versions 18.0-19.2...

WordPress miniOrange 2FA plugin 6.2.8-6.3.0 - 2FA Bypass vulnerability

2FA Bypass vulnerability discovered by pervinzahidli in WordPress Plugin miniOrange's Google Authenticator versions 6.2.8-6.3.0...

CVE-2026-86813

The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers to inject additional email headers, such as Bcc, into the emails the site sends when a submitted...

CVE-2026-82213

The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature...

EUVD-2026-76041

The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers to inject additional email headers, such as Bcc, into the emails the site sends when a submitted...

CVE-2026-86813

CVE-2026-86813 affects the MetForm WordPress plugin prior to version 4.1.9 . The vulnerability resides in how the plugin handles newline characters in user-submitted values that are placed into notification email headers, specifically the Reply-To field. An unauthenticated attacker can inject add...

WordPress MetForm plugin < 4.1.9 - Unauthenticated Email Header Injection vulnerability

Unauthenticated Email Header Injection vulnerability discovered by Artus KG in WordPress Plugin Metform versions 4.1.9...

CVE-2026-86813 MetForm < 4.1.9 - Unauthenticated Email Header Injection via Notification Reply-To

The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers to inject additional email headers, such as Bcc, into the emails the site sends when a submitted...

CVE-2026-86813 MetForm < 4.1.9 - Unauthenticated Email Header Injection via Notification Reply-To

The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers to inject additional email headers, such as Bcc, into the emails the site sends when a submitted...

EUVD-2026-76040

The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained...