WordPress BlogVault Backup & Staging plugin 5.16-6.62 - Unauthenticated Site Takeover via Connection Key Recovery vulnerability

Unauthenticated Site Takeover via Connection Key Recovery vulnerability discovered by Jakub Herman in WordPress Plugin BlogVault versions 5.16-6.62...

WordPress The WP Remote WordPress plugin 5.16-6.62 - Unauthenticated Site Takeover via Connection Key Recovery vulnerability

Unauthenticated Site Takeover via Connection Key Recovery vulnerability discovered by Jakub Herman in WordPress Plugin The WP Remote WordPress Plugin versions 5.16-6.62...

WordPress CM Map Locations plugin <= 2.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via cmloc_route_image_upload AJAX Action vulnerability

Authenticated Subscriber+ Arbitrary File Upload via cmlocrouteimageupload AJAX Action vulnerability discovered by Spy0x7 in WordPress Plugin CM Map Locations versions = 2.1.8...

Exploit for CVE-2026-19632

TranslatePress Password Reset Link Disclosure to Administrator...

CVE-2026-75977

The Mang Board WP plugin for WordPress is vulnerable to Missing Authorization via Authentication Cookie Forgery in all versions up to, and including, 2.3.7. This is due to flawed HMAC generation in the mbwgethashkey function that uses the current user's identity instead of the cookie username...

CVE-2026-18884

The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi...

WordPress Mang Board WP plugin <= 2.3.7 - Authenticated (Subscriber+) Privilege Escalation to Forged Authentication Cookie vulnerability

Authenticated Subscriber+ Privilege Escalation to Forged Authentication Cookie vulnerability discovered by daroo in WordPress Plugin Mang Board WP versions = 2.3.7...

WordPress Simple Newsletter Plugin plugin < 4.3.3 - Unauthenticated Subscriber PII and confirm_key Disclosure vulnerability

Unauthenticated Subscriber PII and confirmkey Disclosure vulnerability discovered by Shivamani Vastrala in WordPress Plugin Noptin versions 4.3.3...

WordPress Tutor LMS plugin 4.0.0-4.0.6 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Jakub Herman in WordPress Plugin Tutor LMS versions 4.0.6...

WordPress Fusion Builder plugin <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write vulnerability

Unauthenticated Remote Code Execution via Arbitrary File Write vulnerability discovered by WordFence in WordPress Plugin Fusion Builder versions = 3.16...

EUVD-2026-66335

The Mang Board WP plugin for WordPress is vulnerable to Missing Authorization via Authentication Cookie Forgery in all versions up to, and including, 2.3.7. This is due to flawed HMAC generation in the mbwgethashkey function that uses the current user's identity instead of the cookie username...

CVE-2026-75977 Mang Board WP <= 2.3.7 - Authenticated (Subscriber+) Privilege Escalation to Forged Authentication Cookie

The Mang Board WP plugin for WordPress is vulnerable to Missing Authorization via Authentication Cookie Forgery in all versions up to, and including, 2.3.7. This is due to flawed HMAC generation in the mbwgethashkey function that uses the current user's identity instead of the cookie username...

CVE-2026-75977

Mang Board WP WordPress plugin (all versions ≤ 2.3.7 ) suffers from a Missing Authorization vulnerability via authentication cookie forgery. The root cause is flawed HMAC generation in mbw_get_hash_key(), which uses the current user's identity instead of the cookie's username parameter when a Wor...

EUVD-2026-66333

The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi...

CVE-2026-18884

The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection in all versions up to and including 2.2.9 . The root cause is insufficient escaping of the orderby and order GET parameters, combined with a lack of sufficient preparation on the existing SQL query. This flaw a...

WordPress WP Data Access plugin <= 5.5.68 - Unauthenticated Insecure Direct Object Reference to Data Access vulnerability

Unauthenticated Insecure Direct Object Reference to Data Access vulnerability discovered by type5afe in WordPress Plugin WP Data Access versions = 5.5.68...

WordPress Greenshift plugin <= 12.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data URI vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Data URI vulnerability discovered by WordFence in WordPress Plugin Greenshift versions = 12.8.9...

WordPress Project Manager plugin 2.1.0-4.0.6 - Unauthenticated Subscriber Account Creation vulnerability

Unauthenticated Subscriber Account Creation vulnerability discovered by Usama Arshad in WordPress Plugin WP Project Manager versions 2.1.0-4.0.6...

CVE-2026-18331

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frmuserid' parameter in all versions up to, and including, 6.33.1 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-78146

The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request before rendering that subscriber's stored details, allowing unauthenticated users to disclose a subscriber's personal data along with the key that authorises...