WordPress TrueBooker Appointment Booking plugin < 1.2.7 - Unauthenticated Arbitrary Appointment Status Change via update_appointment_status vulnerability

Unauthenticated Arbitrary Appointment Status Change via updateappointmentstatus vulnerability discovered by Mokksh Parekh in WordPress Plugin TrueBooker versions 1.2.7...

WordPress TrueBooker Appointment Booking plugin < 1.2.7 - Unauthenticated Customer PII Disclosure via Multiple AJAX Actions vulnerability

Unauthenticated Customer PII Disclosure via Multiple AJAX Actions vulnerability discovered by Luka Zimonjic in WordPress Plugin TrueBooker versions 1.2.7...

WordPress TrueBooker Appointment Booking plugin < 1.2.7 - Unauthenticated Account Takeover via Multiple AJAX Actions vulnerability

Unauthenticated Account Takeover via Multiple AJAX Actions vulnerability discovered by Abdullah Kareem in WordPress Plugin TrueBooker versions 1.2.7...

WordPress WP Maps plugin < 4.9.8 - Subscriber+ Unlimited Autoloaded Option Creation vulnerability

Subscriber+ Unlimited Autoloaded Option Creation vulnerability discovered by Xanlar Agamalizade in WordPress Plugin WP Maps versions 4.9.8...

WordPress JetEngine plugin < 3.8.14 - Author+ Stored XSS via SVG Upload vulnerability

Author+ Stored XSS via SVG Upload vulnerability discovered by Erwan LR WPScan in WordPress Plugin JetEngine versions 3.8.14...

WordPress WP Directory Kit plugin < 1.5.7 - Unauthenticated User Email Disclosure via select_2_ajax_user vulnerability

Unauthenticated User Email Disclosure via select2ajaxuser vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Directory Kit versions 1.5.7...

WordPress W3 Total Cache plugin < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key vulnerability

Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key vulnerability discovered by Jakub Herman in WordPress Plugin W3 Total Cache versions 2.10.5...

WordPress TabaPay Gateway plugin <= 1.4.0 - Unauthenticated Account Takeover via Payment Callback vulnerability

Unauthenticated Account Takeover via Payment Callback vulnerability discovered by moonge in WordPress Plugin TabaPay Gateway versions = 1.4.0...

WordPress Product Shortlist plugin <= 1.0.4 - Unauthenticated SQL Injection via get_shortlisted_products vulnerability

Unauthenticated SQL Injection via getshortlistedproducts vulnerability discovered by João Ramos Maciel in WordPress Plugin Product Shortlist versions = 1.0.4...

WordPress Simple File List plugin <= 6.3.11 - Unauthenticated Stored XSS via File Description vulnerability

Unauthenticated Stored XSS via File Description vulnerability discovered by Ruwantha Harshamal in WordPress Plugin Simple File List versions = 6.3.11...

WordPress Simple File List plugin <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal vulnerability

Unauthenticated Arbitrary File Read and Move via Path Traversal vulnerability discovered by Sanjar Tulkinov in WordPress Plugin Simple File List versions = 6.3.11...

WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Unauthenticated Stored XSS via SVG File Upload vulnerability

Unauthenticated Stored XSS via SVG File Upload vulnerability discovered by Samdup Choephel in WordPress Plugin Booking calendar, Appointment Booking System versions = 3.2.36...

WordPress TenWeb Speed Optimizer plugin < 2.33.5 - Unauthenticated Stored XSS via Critical CSS Token Bypass vulnerability

Unauthenticated Stored XSS via Critical CSS Token Bypass vulnerability discovered by Jakub Herman in WordPress Plugin 10Web Booster – Website speed optimization, Cache & Page Speed optimizer versions 2.33.5...

WordPress Eventin plugin < 4.1.21 - Contributor+ User Role and Meta Modification via Speaker Creation vulnerability

Contributor+ User Role and Meta Modification via Speaker Creation vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WP Event SOlution versions 4.1.21...

WordPress Gift Cards For WooCommerce Pro plugin < 4.2.10 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Brandon Steed in WordPress Plugin Gift Cards For WooCommerce Pro versions 4.2.10...

CVE-2026-19085

The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable...

CVE-2026-19435

The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content...

CVE-2026-18781

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server...

CVE-2026-14601

The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks...

CVE-2026-16959

The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection...