CVE-2026-16567 Document Embedder < 2.3.1 - Unauthenticated Private Document Download via Token Oracle

The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by...

WordPress JetBackup plugin 3.1.18.8-3.1.23.3 - Admin+ Multisite Network Backup Download vulnerability

Admin+ Multisite Network Backup Download vulnerability discovered by Akshat Parikh SN1PER in WordPress Plugin Backup Guard versions 3.1.18.8-3.1.23.3...

WordPress Defender Security plugin < 6.2.0 - Admin+ Network-Wide RCE vulnerability

Admin+ Network-Wide RCE vulnerability discovered by Jakub Herman in WordPress Plugin Defender Security versions 6.2.0...

EUVD-2026-66874

The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

WordPress Mobile App for WooCommerce plugin <= 0.4.69 - Other Vulnerability Type vulnerability

Other Vulnerability Type vulnerability discovered by TruongLV1 From FPT Night Wolf in WordPress Plugin Mobile App for WooCommerce versions = 0.4.69...

CVE-2026-19454 JetBackup 3.1.18.8 - 3.1.23.3 - Admin+ Multisite Network Backup Download

The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is not a Super Admin to download a full backup of the entire network, including every site's data...

CVE-2026-16568

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service WordPress plugin (versions

EUVD-2026-66870

The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by...

CVE-2026-19454

The JetBackup WordPress plugin (versions prior to 3.1.23.5 ) contains an incorrect authorization flaw. The plugin fails to perform a proper multisite authorization check before serving backup archives and job logs. This allows an administrator of the network's main site who lacks Super Admin priv...

CVE-2026-13414 CMP - Coming Soon & Maintenance < 4.1.18 - Unauthenticated Maintenance Mode Disable via cmp_disable_comingsoon_ajax

The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain and exposed to anonymous visitors on others, allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a...

EUVD-2026-66867

The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain and exposed to anonymous visitors on others, allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a...

CVE-2026-13414 CMP - Coming Soon & Maintenance < 4.1.18 - Unauthenticated Maintenance Mode Disable via cmp_disable_comingsoon_ajax

The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain and exposed to anonymous visitors on others, allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a...

CVE-2026-13414

The CMP - Coming Soon & Maintenance WordPress plugin (versions before 4.1.18 ) is vulnerable to an unauthenticated maintenance mode disable vulnerability. The root cause is a lack of authorization checks on one of its AJAX actions, specifically cmp_disable_comingsoon_ajax. Furthermore, the plugin...

EUVD-2026-66868

The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls to...

WordPress CMP plugin < 4.1.18 - Editor+ Stored XSS vulnerability

Editor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin CMP – Coming Soon & Maintenance versions 4.1.18...

EUVD-2026-66869

The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Editor role when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls to inject...

CVE-2026-13416

The CMP - Coming Soon & Maintenance WordPress plugin (versions before 4.1.18 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The application fails to properly sanitize and escape a settings value before displaying it on the coming-soon page . This allows users with the Editor role —s...

CVE-2026-13416 CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Stored XSS via niteoCS_socialmedia

The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Editor role when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls to inject...

PT-2026-82386

The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by...

CVE-2026-78139: Authorization Bypass Through User-Controlled Key

The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product...