WordPress VikAppointments Services Booking Calendar plugin <= 1.2.20 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Supakiad S. m3ez in WordPress Plugin VikAppointments Services Booking Calendar versions = 1.2.20...

WordPress BookIt plugin <= 2.6.0.3 - Bypass Vulnerability vulnerability

Bypass Vulnerability vulnerability discovered by sungbyeongchan in WordPress Plugin BookIt versions = 2.6.0.3...

WordPress Quick Event Manager plugin <= 9.18 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by she11f in WordPress Plugin Quick Event Manager versions = 9.18...

WordPress Timetics plugin <= 1.0.61 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by NamDang in WordPress Plugin Timetics versions = 1.0.61...

WordPress JobSearch plugin <= 3.2.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Phat RiO in WordPress Plugin JobSearch versions = 3.2.0...

WordPress Mail Mint plugin <= 1.31.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by WiniS in WordPress Plugin Mail Mint versions = 1.31.0...

WordPress WPFunnels plugin <= 3.12.13 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin WPFunnels versions = 3.12.13...

WordPress Business Directory plugin <= 6.4.26 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by nh4tvd in WordPress Plugin Business Directory versions = 6.4.26...

Exploit for CVE-2026-13001

CVE-2026-13001 — Podlove Podcast Publisher Unauthenticated File...

WordPress FluentBooking Pro plugin <= 2.2.1 - Bypass Vulnerability vulnerability

Bypass Vulnerability vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin FluentBooking Pro versions = 2.2.1...

WordPress Pre-Orders for WooCommerce plugin <= 2.3.1 - Bypass Vulnerability vulnerability

Bypass Vulnerability vulnerability discovered by MoonFuji in WordPress Plugin Pre-Orders for WooCommerce versions = 2.3.1...

WordPress WC Ukraine Shipping plugin <= 1.22.5 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin WC Ukraine Shipping versions = 1.22.5...

WordPress Business Directory plugin <= 6.4.26 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by sungbyeongchan in WordPress Plugin Business Directory versions = 6.4.26...

WordPress Shared Files Pro plugin < 1.7.70 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by Erwan LR WPScan in WordPress Plugin Shared Files Pro versions 1.7.70...

WordPress Simple Ajax Chat plugin < 20260827 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin Simple Ajax Chat versions 20260827...

WordPress FAQ Builder AYS plugin 1.6.3-1.8.4 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin FAQ Builder AYS versions 1.6.3-1.8.4...

WordPress theme My Login plugin 7.0-7.1.15 - Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation vulnerability

Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation vulnerability discovered by Jakub Herman in WordPress Plugin Theme My Login versions 7.0-7.1.15...

WordPress RegistrationMagic plugin < 6.0.9.9 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Sai Praneeth Koti in WordPress Plugin RegistrationMagic versions 6.0.9.9...

WordPress Rank Math SEO plugin < 1.0.277 - Author+ Robots and Pillar Content Meta Update on Non-Owned Objects vulnerability

Author+ Robots and Pillar Content Meta Update on Non-Owned Objects vulnerability discovered by Project Black in WordPress Plugin Rank Math SEO versions 1.0.277...

WordPress GamiPress plugin < 7.9.9.6 - Subscriber+ Arbitrary User Points and Achievement Award vulnerability

Subscriber+ Arbitrary User Points and Achievement Award vulnerability discovered by Shivamani Vastrala in WordPress Plugin GamiPress versions 7.9.9.6...