CVE-2026-109147 WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter

The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators...

CVE-2026-109926 Productive Commerce < 1.1.49 - Subscriber+ Arbitrary Plugin Activation

The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbitrary Productive Commerce WordPress plugin befo...

CVE-2026-108073 SureCart < 4.9.5 - Unauthenticated Private Catalog Data Disclosure via 'expand' Parameter

The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API, nor strip private fields from those objects, allowing unauthenticated users to read merchant-private catalog data such as...

CVE-2026-110514 WPZOOM Portfolio < 1.4.34 - Contributor+ Arbitrary Post/Page Type Overwrite via IDOR

The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order, which could allow users with the contributor role and above to convert any other user's posts and pages into portfolio items, removing them from their...

CVE-2026-110514 WPZOOM Portfolio < 1.4.34 - Contributor+ Arbitrary Post/Page Type Overwrite via IDOR

The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order, which could allow users with the contributor role and above to convert any other user's posts and pages into portfolio items, removing them from their...

EUVD-2026-107068

The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order, which could allow users with the contributor role and above to convert any other user's posts and pages into portfolio items, removing them from their...

CVE-2026-108073

The SureCart WordPress plugin, in versions prior to 4.9.5 , is vulnerable to an unauthenticated private catalog data disclosure. The root cause is that the plugin fails to restrict related objects or strip private fields when an anonymous visitor reads a single upsell funnel via the REST API . Th...

CVE-2026-108073 SureCart < 4.9.5 - Unauthenticated Private Catalog Data Disclosure via 'expand' Parameter

The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API, nor strip private fields from those objects, allowing unauthenticated users to read merchant-private catalog data such as...

CVE-2026-109926

The Productive Commerce WordPress plugin, in versions prior to 1.1.49 , is vulnerable to unauthorized plugin activation due to a missing capability check in one of its AJAX actions. Because the plugin exposes the required nonce on every admin-area page, any authenticated user , such as a subscrib...

CVE-2026-110514

The WPZOOM Portfolio Lite WordPress plugin (versions before 1.4.34 ) contains an Authorization Bypass vulnerability (CWE-639). The application fails to verify if a user has the necessary permissions to edit a post before allowing modifications to its type and order . This flaw enables users with ...

CVE-2026-107789

The SmartyParcel WordPress plugin versions before 1.23.4 is vulnerable to an unauthenticated shipping label disclosure due to a lack of authorization checks. An attacker can obtain shipping labels for arbitrary orders, which contain sensitive information such as customer names, addresses, and pho...

CVE-2026-107788

The SmartyParcel WordPress plugin (also known as WC Ukr Shipping ) before version 1.23.4 is vulnerable to a missing authorization check. This flaw allows any authenticated user , such as a subscriber, to delete shipping label and tracking records for arbitrary orders across the entire store. No s...

CVE-2026-107789 SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers...

CVE-2026-107788 SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide...

CVE-2026-107788 SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide...

CVE-2026-107789 SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers...

CVE-2026-106932

The Moloni WordPress plugin versions prior to 5.0.14 is vulnerable to an authorization bypass. The plugin fails to perform capability or nonce checks on several authenticated AJAX actions, relying instead on the presence of a stored connection to an external invoicing provider. This allows any au...

EUVD-2026-107056

The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses...

CVE-2026-106932 Moloni < 5.0.14 - Subscriber+ Arbitrary Order Invoice Generation via genInvoice

The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authenticated user such as a Subscriber to generate fisca...

CVE-2026-106932 Moloni < 5.0.14 - Subscriber+ Arbitrary Order Invoice Generation via genInvoice

The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authenticated user such as a Subscriber to generate fisca...