CVE-2026-73341

The WordPress RegistrationMagic plugin (versions

CVE-2026-73341

Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...

EUVD-2026-60771

Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...

CVE-2026-73341 WordPress RegistrationMagic plugin <= 6.0.9.7 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...

CVE-2026-73339 WordPress Modern Events Calendar plugin < 7.35.0 - SQL Injection vulnerability

Unauthenticated SQL Injection in Modern Events Calendar 7.35.0 versions...

CVE-2026-73338

The WordPress Autopay plugin (versions ≤ 5.0.0) has an unauthenticated reflected/stored XSS flaw, exploitable via a network request with no authentication. CVSS 7.1 (HIGH) reflects low confidentiality/integrity/availability impact. Exploitation details are not provided; update to a patched versio...

CVE-2026-73190 WordPress WPDM – Premium Packages plugin <= 7.0.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in W3 Eden WPDM – Premium Packages wpdm-premium-packages allows DOM-Based XSS.This issue affects WPDM – Premium Packages: from n/a through 7.0.5...

CVE-2026-73190 WordPress WPDM – Premium Packages plugin <= 7.0.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WPDM – Premium Packages = 7.0.5 versions...

CVE-2026-73187

Unauthenticated SQL Injection in Sticky Chat Widget = 1.4.2 versions...

CVE-2026-73187

The WordPress Sticky Chat Widget plugin (versions ≤ 1.4.2) contains an unauthenticated SQL Injection vulnerability, discovered by Nguyen Ba Khanh of HPT Vietnam Corporation. CVSS 3.1 scores it 9.3 (Critical) for network-exploitable high confidentiality impact. CISA SSVC rates it automatable with ...

EUVD-2026-60938

Unauthenticated SQL Injection in Sticky Chat Widget = 1.4.2 versions...

CVE-2026-68568

WordPress MasterStudy LMS plugin (≤ 3.7.41) allows authenticated subscribers to escalate privileges, likely by bypassing capability checks in REST endpoints or AJAX handlers. CVSS 6.3 (medium) — network attack, low privileges required. No in-the-wild exploitation reported. Upgrade to a patched ve...

CVE-2026-68567 WordPress EasyTest – Simplify A/B Testing plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Grids EasyTest – Simplify A/B Testing convertpro allows DOM-Based XSS.This issue affects EasyTest – Simplify A/B Testing: from n/a through 1.0.1...

EUVD-2026-60933

Unauthenticated Broken Access Control in Appointment Hour Booking = 1.5.91 versions...

EUVD-2026-60932

Unauthenticated Cross Site Scripting XSS in Templately = 3.7.1 versions...

CVE-2026-66667

The WordPress Templately plugin (versions ≤ 3.7.1) contains an unauthenticated reflected/stored XSS vulnerability discovered by researcher daroo, rated CVSS 7.1 (HIGH). Attackers can inject malicious scripts via network requests requiring no authentication, potentially compromising user sessions ...

CVE-2026-66651

Unauthenticated Broken Access Control in MultiVendorX = 5.0.14 versions...

CVE-2026-66646

Contributor Cross Site Scripting XSS in WP Tab Widget = 1.2.11 versions...

CVE-2026-66645 WordPress Table Of Contents Block plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Table Of Contents Block = 1.5.0 versions...

CVE-2026-66645

The WordPress Table Of Contents Block plugin (≤1.5.0) allows authenticated contributors to inject cross-site scripting payloads. CVSS 3.1 scores 6.5 (Medium) with network attack vector and low privileges required. No exploit code or in-the-wild exploitation is documented in the provided materials.