WordPress ShopEngine plugin < 4.9.3 - Customer PII Disclosure via Forced Authentication vulnerability

Customer PII Disclosure via Forced Authentication vulnerability discovered by Farid Narimanov in WordPress Plugin ShopEngine versions 4.9.3...

WordPress Amelia plugin < 2.4.6 - Provider+ Cross-Customer Appointment Data Disclosure via IDOR vulnerability

Provider+ Cross-Customer Appointment Data Disclosure via IDOR vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Amelia versions 2.4.6...

WordPress Fluent Forms plugin <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values vulnerability

Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values vulnerability discovered by Adrien Brunner in WordPress Plugin FluentForm versions = 6.2.11...

WordPress Prevent Direct Access - Protect WordPress Files plugin <= 2.8.8.8 - Unauthenticated Protected File Access vulnerability

WordPress Prevent Direct Access - Protect WordPress Files plugin = 2.8.8.8 - Unauthenticated Protected File Access vulnerability discovered by Lucas Montes NiRoX in WordPress Plugin Prevent Direct Access versions = 2.8.8.8...

WordPress Quick PayPal Payments plugin <= 5.7.50 - Unauthenticated Payment Bypass via PayPal IPN vulnerability

Unauthenticated Payment Bypass via PayPal IPN vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Quick Paypal Payments versions = 5.7.50...

WordPress Welcart e-Commerce plugin < 2.11.33 - Unauthenticated Payment Bypass via Forged Settlement Callback vulnerability

Unauthenticated Payment Bypass via Forged Settlement Callback vulnerability discovered by Pedro Pinho in WordPress Plugin Welcart e-Commerce versions 2.11.33...

WordPress Wallet System for WooCommerce plugin < 2.7.10 - Customer+ Checkout Price Manipulation via Unvalidated Wallet Amount vulnerability

Customer+ Checkout Price Manipulation via Unvalidated Wallet Amount vulnerability discovered by takuma in WordPress Plugin Wallet System for WooCommerce versions 2.7.10...

WordPress Royal Elementor Addons plugin < 1.7.1065 - Contributor+ Stored XSS via Icon Box Widget vulnerability

Contributor+ Stored XSS via Icon Box Widget vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Royal Elementor Addons versions 1.7.1065...

WordPress Order Sync with Zendesk for WooCommerce plugin < 2.2.3 - Unauthenticated Customer Order Data Disclosure vulnerability

Unauthenticated Customer Order Data Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Order Sync with Zendesk for WooCommerce versions 2.2.3...

WordPress ProSolution WP Client plugin < 2.0.9 - Subscriber+ proSol_ajaxTablesync and proSol_ajaxClearlog Calls vulnerability

Subscriber+ proSolajaxTablesync and proSolajaxClearlog Calls vulnerability discovered by Nir Yehoshua in WordPress Plugin ProSolution WP Client versions 2.0.9...

WordPress WP Photo Album Plus plugin < 9.2.09.002 - Subscriber+ Cross-Album File Upload via Missing Authorization vulnerability

Subscriber+ Cross-Album File Upload via Missing Authorization vulnerability discovered by Farid Narimanov in WordPress Plugin WP Photo Album Plus versions 9.2.09.002...

CVE-2026-19794

The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...

WordPress Form Maker by 10Web plugin < 1.15.45 - Subscriber+ SQL Injection via display_name vulnerability

Subscriber+ SQL Injection via displayname vulnerability discovered by Revanth Meesala in WordPress Plugin Form Maker by 10Web versions 1.15.45...

WordPress WP Photo Album Plus plugin < 9.2.07.002 - Unauthenticated Option Disclosure via gettogo vulnerability

Unauthenticated Option Disclosure via gettogo vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Photo Album Plus versions 9.2.07.002...

WordPress Cookie Consent plugin < 0.0.10 - Subscriber+ MaxMind License Key Update vulnerability

Subscriber+ MaxMind License Key Update vulnerability discovered by Erwan LR WPScan in WordPress Plugin Cookie Consent – GDPR & CCPA Cookie Banner & Consent Manager versions 0.0.10...

WordPress Blubrry PowerPress plugin < 11.17.1 - Contributor+ Server-Side Request Forgery via Podcast Episode Chapters URL vulnerability

Contributor+ Server-Side Request Forgery via Podcast Episode Chapters URL vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin PowerPress Podcasting versions 11.17.1...

WordPress Total Upkeep (BoldGrid Backup) plugin < 1.17.3 - Unauthenticated Sensitive Data Disclosure and Forced Site Restore via Predictable cron_secret (regression of CVE-2020-36848) vulnerability

Unauthenticated Sensitive Data Disclosure and Forced Site Restore via Predictable cronsecret regression of CVE-2020-36848 vulnerability discovered by Jakub Herman in WordPress Plugin Total Upkeep versions 1.17.3...

WordPress Welcart e-Commerce plugin < 2.11.34 - Author+ Stored XSS via Product Name vulnerability

Author+ Stored XSS via Product Name vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Welcart e-Commerce versions 2.11.34...

WordPress WP Crowdfunding plugin < 2.2.1 - Subscriber+ Campaign Creation via Missing Authorization vulnerability

Subscriber+ Campaign Creation via Missing Authorization vulnerability discovered by Sajjad Haqi in WordPress Plugin WP Crowdfunding versions 2.2.1...

WordPress Import WP plugin < 2.14.23 - Unauthenticated Sensitive Information Exposure via Export File Download vulnerability

Unauthenticated Sensitive Information Exposure via Export File Download vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Import WP versions 2.14.23...