EUVD-2026-74606

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to, and including, 1.31.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-19800 Mail Mint <= 1.31.0 - Authenticated (Custom+) SQL Injection via 'status' Parameter

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to, and including, 1.31.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-11363 Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...

CVE-2026-19800

Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails (WordPress plugin) is vulnerable to SQL Injection via the status parameter in all versions up to and including 1.31.0 . The root cause is that an attacker-controlled $contact_filter_query fragment is concatenated into ...

CVE-2026-19797 User Access Manager <= 2.3.18 - Reflected Cross-Site Scripting via 'tab_group_section' Parameter

The User Access Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tabgroupsection' parameter in all versions up to, and including, 2.3.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-19797

User Access Manager is a WordPress plugin vulnerable to Reflected Cross-Site Scripting (XSS) via the tab_group_section parameter in all versions up to and including 2.3.18 . The root cause is insufficient input sanitization and output escaping . An unauthenticated attacker who can trick a victim ...

CVE-2026-77186 My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attribute in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2026-77187 My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

CVE-2026-77186 My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attribute in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

EUVD-2026-74603

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attribute in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2026-77186

The My Calendar – Accessible Event Manager WordPress plugin (versions ≤ 3.8.3 ) is vulnerable to Stored Cross-Site Scripting via the fallback shortcode attribute. Authenticated users with contributor-level access or higher can inject arbitrary scripts by submitting hex-encoded payloads (e.g. \x3c...

EUVD-2026-74605

The User Access Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tabgroupsection' parameter in all versions up to, and including, 2.3.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-77187 My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

CVE-2026-7804

The Product Filter for WooCommerce by WBW WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the wpf_fid parameter in all versions up to and including 3.4.2 . The root cause is insufficient input sanitization and output escaping , allowing unauthenticated attackers to inject arb...

CVE-2026-7804 Product Filter for WooCommerce by WBW <= 3.4.2 - Reflected Cross-Site Scripting via 'wpf_fid' Parameter

The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpffid' parameter in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-7804 Product Filter for WooCommerce by WBW <= 3.4.2 - Reflected Cross-Site Scripting via 'wpf_fid' Parameter

The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpffid' parameter in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-17553

The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to and including 5.9.3 . The ec_ajax_save_page_default_options() AJAX handler iterates over every $_POST key and passes it directly into update_option() without an allowlist. Access is gated on the manage_op...

CVE-2026-17553 Shopping Cart & eCommerce Store <= 5.9.3 - Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action

The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ecajaxsavepagedefaultoptions AJAX handler iterating over every $POST key and passing it directly into updateoption without any allowlist, while gating the handler...

CVE-2026-12956

The WP Event Solution Eventin plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the createitem handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's createitempermissionscheck function only verifies a wprest nonce which is...

CVE-2026-13359

The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cntctfrmcontactdropdown Parameter in all versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This makes...