CVE-2026-19430

The Catfolders Document Gallery Pro WordPress plugin, in versions before 2.0.7 , contains an unauthenticated missing authorization vulnerability. The root cause is that certain REST API routes lack proper authorization, combined with a client-side forgeable token used to identify content. This al...

CVE-2026-19430 CatFolders Document Gallery Pro < 2.0.7 - Unauthenticated Missing Authorization via download-all

The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and the token identifying the requested content is forgeable client side, allowing unauthenticated users to list and download the contents of folders that were never published on the...

CVE-2026-18234 MStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid...

CVE-2026-76548 Profile Builder < 4.0.1 - Unauthenticated Unpublished Content and Media Modification via Front-End Upload Auth Bypass

The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media item...

WordPress User Profile Builder plugin < 4.0.1 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Profile Builder versions 4.0.1...

EUVD-2026-68045

The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value, allowing unauthenticated attackers to compute the key and perform privileged actions such as adding and deleting subscribers and sending emails,...

WordPress Newsletters plugin < 4.17 - Arbitrary Plugin Option Update vulnerability

Arbitrary Plugin Option Update vulnerability discovered by Erwan LR WPScan in WordPress Plugin Newsletters versions 4.17...

EUVD-2026-68047

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made...

CVE-2026-18233 MStore API < 4.21.1 - Subscriber+ Arbitrary Order Completion

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made...

WordPress MStore API plugin < 4.21.1 - Subscriber+ Arbitrary Order Completion vulnerability

Subscriber+ Arbitrary Order Completion vulnerability discovered by Erwan LR WPScan in WordPress Plugin MStore API versions 4.21.1...

CVE-2026-17520 Newsletters < 4.17 - Unauthenticated API Access via Predictable API Key

The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value, allowing unauthenticated attackers to compute the key and perform privileged actions such as adding and deleting subscribers and sending emails,...

CVE-2026-17520

The Newsletters WordPress plugin (versions before 4.17 ) contains a vulnerability where the API key is not generated using a sufficiently random source. Instead, it is derived from a publicly known value , which allows unauthenticated attackers to compute the key. If the optional API is enabled, ...

CVE-2026-18233 MStore API < 4.21.1 - Subscriber+ Arbitrary Order Completion

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made...

CVE-2026-18233

The MStore API WordPress plugin in versions before 4.21.1 is vulnerable to an authorization bypass. The plugin fails to verify that an order targeted by one of its delivery endpoints belongs to the requester. This flaw allows any authenticated user , including those with Subscriber privileges, to...

CVE-2026-16600 SmartAIPress <= 1.2.0 - Subscriber+ Server-Side Request Forgery via smartaipress_openai_upload_and_set_featured_image

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external...

CVE-2026-16600

The SmartAIPress WordPress plugin (versions

EUVD-2026-68043

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external...

CVE-2026-16600 SmartAIPress <= 1.2.0 - Subscriber+ Server-Side Request Forgery via smartaipress_openai_upload_and_set_featured_image

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external...

CVE-2026-17522

The Newsletters WordPress plugin (versions before 4.17 ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack because it fails to perform necessary nonce or capability checks when saving specific settings screens. This allows an attacker to trick a logged-in administrator into submitting a...

CVE-2026-17522 Newsletters < 4.17 - Arbitrary Plugin Option Update via CSRF

The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin...