EUVD-2026-75028

Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wphandleupload that disables WordPress core's file type validati...

CVE-2026-26212

The Rara One Click Demo Import WordPress plugin before version 1.3.5 contains an arbitrary file upload vulnerability. Authenticated attackers with Administrator privileges can pass a false value to wp_handle_upload() , disabling WordPress core's file type validation across all three file paramete...

CVE-2026-26212 Rara One Click Demo Import < 1.3.5 Arbitrary File Upload RCE

Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wphandleupload that disables WordPress core's file type validati...

WordPress Builderall for WordPress plugin <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Post Meta Modification vulnerability discovered by Wordfence PRISM in WordPress Plugin Builderall Builder for WordPress versions = 3.0.2...

WordPress Builderall for WordPress plugin <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Builderall Builder for WordPress versions = 3.0.2...

WordPress Builderall for WordPress plugin <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Builderall Builder for WordPress versions = 3.0.2...

CVE-2026-82530 IP2Location Country Blocker < 2.45.0 Access Control Bypass via X-Real-IP Header

IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to circumvent IP-based restrictions by forging the X-Real-IP HTTP header. Attackers can set the X-Real-IP header to an allowlisted IP address...

CVE-2026-82530 IP2Location Country Blocker < 2.45.0 Access Control Bypass via X-Real-IP Header

IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to circumvent IP-based restrictions by forging the X-Real-IP HTTP header. Attackers can set the X-Real-IP header to an allowlisted IP address...

EUVD-2026-75018

IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to circumvent IP-based restrictions by forging the X-Real-IP HTTP header. Attackers can set the X-Real-IP header to an allowlisted IP address...

WordPress Brevo – Email, SMS, Web Push, Chat, and more. plugin <= 3.1.77 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by stealthcopter in WordPress Plugin Brevo versions = 3.1.77...

WordPress TelSender – Сontact form 7, Events, Wpforms, ninja forms and woocommerce to telegram bot plugin <= 1.14.14 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Kai Aizen in WordPress Plugin TelSender versions = 1.14.14...

WordPress Podlove Podcast Publisher plugin <= 4.5.1 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by an unknown individual in WordPress Plugin Podlove Podcast Publisher versions = 4.5.1...

WordPress Drag and Drop File Upload for Elementor Forms plugin <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter vulnerability

Unauthenticated Arbitrary File Upload via 'type' Parameter vulnerability discovered by Adam Rayyan Aryasatya in WordPress Plugin Drag and Drop File Upload for Elementor Forms versions = 1.6.0...

WordPress CI HUB Connector plugin <= 1.2.106 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin CI HUB Connector versions = 1.2.106...

WordPress SlideShowPro SC plugin <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by MAJidox in WordPress Plugin SlideShowPro SC versions = 1.0.2...

WordPress Inquiry cart plugin <= 3.4.2 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by Muhammad Nur Ibnu Hubab Ibnu - Pondok Teknologi in WordPress Plugin Inquiry Cart versions = 3.4.2...

WordPress Table Manager plugin <= 1.0.0 - Authenticated (Contributor+) Sensitive Information Exposure vulnerability

Authenticated Contributor+ Sensitive Information Exposure vulnerability discovered by Itthidej Aramsri Boeing777 in WordPress Plugin Table Manager versions = 1.0.0...

WordPress Gallagher Website Design plugin <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin Gallagher Website Design versions = 2.6.4...

WordPress TP Restore Categories And Taxonomies plugin <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Taxonomy Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Taxonomy Deletion vulnerability discovered by Nabil Irawan - Heroes Cyber Security in WordPress Plugin TP Restore Categories And Taxonomies versions = 1.0.1...

WordPress CalJ Shabbat Times plugin <= 1.5 - Authenticated (Subscriber+) Arbitrary Settings Modification vulnerability

Authenticated Subscriber+ Arbitrary Settings Modification vulnerability discovered by Nabil Irawan - Heroes Cyber Security in WordPress Plugin CalJ Shabbat Times versions = 1.5...