WordPress Personal QR Message plugin <= 1.0 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by João Ramos Maciel in WordPress Plugin Personal QR Message versions = 1.0...

WordPress Appointment Hour Booking plugin < 1.5.88 - Unauthenticated Booking Price Manipulation via tcost Parameter vulnerability

Unauthenticated Booking Price Manipulation via tcost Parameter vulnerability discovered by Researcher1: Alessandro Greco aka Aleff; Researcher2: Giovambattista Ianni; Company/Organization: University of Calabria UNICAL in WordPress Plugin Appointment Hour Booking versions 1.5.88...

WordPress WP Maps plugin < 4.9.7 - Subscriber+ Denial of Service vulnerability

Subscriber+ Denial of Service vulnerability discovered by Mohammad Aghdasi in WordPress Plugin WP Maps versions 4.9.7...

WordPress Brizy - Page Builder plugin < 2.8.19 - Contributor+ Template Type Update via IDOR vulnerability

WordPress Brizy - Page Builder plugin 2.8.19 - Contributor+ Template Type Update via IDOR vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Brizy versions 2.8.19...

WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Boards Pro versions = 2.0.11...

WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Boards Pro versions = 2.0.11...

WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Boards Pro versions = 2.0.11...

WordPress Fluent Boards Pro plugin <= 2.0.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Boards Pro versions = 2.0.11...

CVE-2026-15985

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the processotplogin function. This makes it possible for unauthenticated...

WordPress SureFeedback Client Site plugin <= 1.2.12 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by doyz in WordPress Plugin SureFeedback Client Site versions = 1.2.12...

WordPress WP Fastest Cache plugin <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Host Header vulnerability

Unauthenticated Stored Cross-Site Scripting via HTTP Host Header vulnerability discovered by Adrien Brunner in WordPress Plugin WP Fastest Cache versions = 1.5.0...

WordPress WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read vulnerability

Authenticated Subscriber+ Arbitrary File Read vulnerability discovered by daroo in WordPress Plugin WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels versions = 4.9.8...

EUVD-2026-66410

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the processotplogin function. This makes it possible for unauthenticated...

CVE-2026-15985 Classified Listing - Mobile Number Verification <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the processotplogin function. This makes it possible for unauthenticated...

CVE-2026-15985 Classified Listing - Mobile Number Verification <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the processotplogin function. This makes it possible for unauthenticated...

WordPress Forminator Forms plugin <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) vulnerability

Unauthenticated Stored Cross-Site Scripting via Radio Field Save and Continue Draft vulnerability discovered by daroo in WordPress Plugin Forminator versions = 1.57.0.2...

WordPress Forminator Forms plugin <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter vulnerability

Unauthenticated DOM-Based Cross-Site Scripting via 'errordescription' Parameter vulnerability discovered by Adrien Brunner in WordPress Plugin Forminator versions = 1.57.0...

CVE-2026-3235

The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'checkappaccess' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from...

CVE-2026-5092

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customapi action handler in versions up to, and including, 12.8.9. This is due to insufficient sanitization of API responses before output via innerHTML. This makes it...

CVE-2026-18080

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 1.17.8 via the saveattachments function. This is due to missing file extension validation and missing path normalization whe...