WordPress User Registration & Membership plugin < 5.2.0 - Unauthenticated Paid Membership Bypass vulnerability

Unauthenticated Paid Membership Bypass vulnerability discovered by John Umoru in WordPress Plugin User Registration versions 5.2.0...

WordPress Salon Booking System plugin < 10.30.20 - Subscriber+ Booking Approval Bypass vulnerability

Subscriber+ Booking Approval Bypass vulnerability discovered by kevin@OPCIA in WordPress Plugin Salon booking system versions 10.30.20...

WordPress WebAuthn Provider for Two Factor plugin < 2.5.6 - 2FA Bypass vulnerability

2FA Bypass vulnerability discovered by Volodymyr Kolesnykov in WordPress Plugin WebAuthn Provider for Two Factor versions 2.5.6...

WordPress WP DSGVO Tools (GDPR) plugin < 3.1.40 - Unauthenticated Sensitive Information Disclosure via Subject Access Request vulnerability

Unauthenticated Sensitive Information Disclosure via Subject Access Request vulnerability discovered by Shivamani Vastrala in WordPress Plugin WP DSGVO Tools GDPR versions 3.1.40...

WordPress WP Support Plus Responsive Ticket System plugin <= 9.1.2 - Unauthenticated Support Ticket Access via Session Cookie Forgery vulnerability

Unauthenticated Support Ticket Access via Session Cookie Forgery vulnerability discovered by Kartik sharma in WordPress Plugin WP Support Plus Responsive Ticket System versions = 9.1.2...

WordPress Fluent Forms plugin < 6.2.1 - Subscriber+ Subscription Cancellation via IDOR vulnerability

Subscriber+ Subscription Cancellation via IDOR vulnerability discovered by Pedro Pinho in WordPress Plugin FluentForm versions 6.2.1...

WordPress Adminify plugin < 4.2.10 - Contributor+ Sensitive Information Disclosure via Global Search AJAX vulnerability

Contributor+ Sensitive Information Disclosure via Global Search AJAX vulnerability discovered by Vaibhav Narkhede in WordPress Plugin WP Adminify versions 4.2.10...

WordPress Everest Forms plugin < 3.5.0 - Unauthenticated Sensitive Information Exposure via Residual CSV Artifacts vulnerability

Unauthenticated Sensitive Information Exposure via Residual CSV Artifacts vulnerability discovered by Duy Tran in WordPress Plugin Everest Forms versions 3.5.0...

CVE-2026-76128

The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-78570

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage...

WordPress Product Configurator for WooCommerce plugin < 1.7.3 - Unauthenticated Private/Draft Product Data Disclosure via pc_get_data vulnerability

Unauthenticated Private/Draft Product Data Disclosure via pcgetdata vulnerability discovered by Ahmed Hashim Ismael in WordPress Plugin Product Configurator for WooCommerce versions 1.7.3...

WordPress Masteriyo LMS plugin < 2.2.1 - Unauthenticated Course Progress Disclosure and Deletion vulnerability

Unauthenticated Course Progress Disclosure and Deletion vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Masteriyo - LMS versions 2.2.1...

WordPress WS Form LITE plugin < 1.11.8 - Subscriber+ Arbitrary Settings Update vulnerability

Subscriber+ Arbitrary Settings Update vulnerability discovered by Mustafa Ahmed in WordPress Plugin WS Form LITE versions 1.11.8...

CVE-2026-76128 eCommerce Product Catalog <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute

The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-78576

The Readabler plugin for WordPress is vulnerable to SQL Injection in all versions up to 2.0.18 (exclusive). The root cause is insufficient escaping of a user-supplied parameter combined with a lack of adequate preparation on the existing SQL query. This allows unauthenticated attackers to append ...

EUVD-2026-65358

The Total Donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This makes it possible for unauthenticated attackers to elevate their privileges to that of an adminsitrator...

EUVD-2026-65357

The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-78576

...

CVE-2026-78576

...

CVE-2026-76128 eCommerce Product Catalog <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute

The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...