WordPress WPLegalPages plugin <= 3.7.0 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by HieuPenguinnn in WordPress Plugin WPLegalPages versions = 3.7.0...

WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Que Thanh Tuan in WordPress Plugin Style Kits versions = 2.6.5...

WordPress Stripe Payments plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Stripe Payments versions = 2.1.2...

WordPress TranslatePress plugin <= 3.3.2 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by ChuongVN in WordPress Plugin TranslatePress versions = 3.3.2...

CVE-2026-66599

Unauthenticated Cross Site Scripting XSS in WPComplete = 2.9.5.6 versions...

CVE-2026-66585

Unauthenticated Sensitive Data Exposure in WP Cafe Pro 3.0.15 versions...

CVE-2026-66587

Unauthenticated Local File Inclusion in WP Cafe Pro 3.0.15 versions...

CVE-2026-32477

Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons = 2.2.0 versions...

CVE-2026-28162

Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...

CVE-2026-28171

Unauthenticated Arbitrary File Deletion in WooCommerce File Approval = 10.7 versions...

WordPress YMC Smart Filter plugin < 3.11.3 - Unauthenticated Private/Draft Post Disclosure vulnerability

Unauthenticated Private/Draft Post Disclosure vulnerability discovered by Ahmed Hashim Ismael in WordPress Plugin Filter & Grids versions 3.11.3...

WordPress BookingPress plugin < 1.5.6 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Sanjar Tulkinov in WordPress Plugin BookingPress versions 1.5.6...

CVE-2026-66587 WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in WP Cafe Pro 3.0.15 versions...

CVE-2026-66585 WordPress WP Cafe Pro plugin < 3.0.15 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in WP Cafe Pro 3.0.15 versions...

CVE-2026-66587 WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in WP Cafe Pro 3.0.15 versions...

CVE-2026-32558 WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin <= 8.9.1 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress = 8.9.1 versions...

CVE-2026-32551 WordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in DiviNext Woo Essential allows SQL Injection. This issue affects Woo Essential: from n/a through 4.3.0...

CVE-2026-32551 WordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in DiviNext Woo Essential allows SQL Injection. This issue affects Woo Essential: from n/a through 4.3.0...

CVE-2026-32478

CVE-2026-32478 is a Subscriber-level SQL Injection vulnerability in the WP Project Manager Pro WordPress plugin (versions ≤ 4.0.1 ), discovered by researcher dutafi . The flaw allows a user with the low-privilege Subscriber role to execute arbitrary SQL queries, resulting in high confidentiality ...

CVE-2026-32478 WordPress WP Project Manager Pro plugin <= 4.0.1 - SQL Injection vulnerability

Subscriber SQL Injection in WP Project Manager Pro = 4.0.1 versions...