EUVD-2026-69933

Unauthenticated Broken Access Control in WP Event SOlution = 4.1.22 versions...

CVE-2026-83562 WordPress WCFM Marketplace plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in WCFM Marketplace = 3.8.2 versions...

CVE-2026-83562

CVE-2026-83562 is a Contributor Cross Site Scripting (XSS) vulnerability in the WordPress plugin WCFM Marketplace (versions ≤ 3.8.2 ). Discovered by Ananda Dhakal via Patchstack, the flaw requires an authenticated contributor-level user and user interaction to exploit, but results in a changed sc...

EUVD-2026-69934

Contributor Cross Site Scripting XSS in WCFM Marketplace = 3.8.2 versions...

CVE-2026-81775

CVE-2026-81775 affects the WordPress Estatik plugin, versions 4.3.4 and below . The vulnerability is an unauthenticated Cross-Site Scripting (XSS) flaw, meaning an attacker can inject malicious scripts without prior authentication. The CVSS 3.1 score is 7.1 (HIGH) with the vector AV:N/AC:L/PR:N/U...

CVE-2026-81775 WordPress Estatik plugin <= 4.3.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Estatik = 4.3.4 versions...

CVE-2026-81774

CVE-2026-81774 affects the WooCommerce Product Attachment WordPress plugin in versions 2.3.3 and below , introducing an unauthenticated Sensitive Data Exposure vulnerability. The flaw allows a remote, unauthenticated attacker over the network to access confidential data, with a CVSS 3.1 base scor...

CVE-2026-81772 WordPress Ninja Forms - Layout & Styles plugin <= 3.0.31 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles = 3.0.31 versions...

CVE-2026-81774 WordPress WooCommerce Product Attachment plugin <= 2.3.4 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dotstore WooCommerce Product Attachment woo-product-attachment allows Retrieve Embedded Sensitive Data.This issue affects WooCommerce Product Attachment: from n/a through 2.3.4...

CVE-2026-81771 WordPress TrustedSite plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in TrustedSite = 1.2.5 versions...

CVE-2026-81770 WordPress Interactive Geo Maps plugin <= 1.6.30 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Interactive Geo Maps = 1.6.30 versions...

CVE-2026-81770 WordPress Interactive Geo Maps plugin <= 1.6.30 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Interactive Geo Maps = 1.6.30 versions...

CVE-2026-81769 WordPress Booking Hub plugin <= 1.3.1 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in LiquidThemes Booking Hub allows Privilege Escalation. This issue affects Booking Hub: from n/a through 1.3.1...

CVE-2026-81769 WordPress Booking Hub plugin <= 1.3.1 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in LiquidThemes Booking Hub allows Privilege Escalation. This issue affects Booking Hub: from n/a through 1.3.1...

CVE-2026-81769

CVE-2026-81769 is an Incorrect Privilege Assignment vulnerability in the LiquidThemes Booking Hub WordPress plugin, affecting versions up to and including 1.3.1 . The flaw allows an attacker with low privileges to escalate access, potentially compromising confidentiality, integrity, and availabil...

CVE-2026-81770

CVE-2026-81770 affects the WordPress Interactive Geo Maps plugin in versions ≤ 1.6.30 . The vulnerability is an unauthenticated Reflected Cross-Site Scripting (XSS) , meaning no prior login is required to exploit it, though user interaction is needed (CVSS 3.1: 7.1 HIGH , vector AV:N/AC:L/PR:N/UI...

CVE-2026-81288 WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Upsell Order Bump Offer for WooCommerce = 3.1.5 versions...

CVE-2026-81288 WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Upsell Order Bump Offer for WooCommerce = 3.1.5 versions...

CVE-2026-81289

CVE-2026-81289 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin, affecting versions 5.13.1 and earlier . The vulnerability requires user interaction (victim must visit a crafted page) but needs no prior au...

CVE-2026-81289 WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.13.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in MP3 Audio Player for Music, Radio & Podcast by Sonaar = 5.13.1 versions...