CVE-2026-107788

The SmartyParcel WordPress plugin (also known as WC Ukr Shipping ) before version 1.23.4 is vulnerable to a missing authorization check. This flaw allows any authenticated user , such as a subscriber, to delete shipping label and tracking records for arbitrary orders across the entire store. No s...

CVE-2026-107789

The SmartyParcel WordPress plugin versions before 1.23.4 is vulnerable to an unauthenticated shipping label disclosure due to a lack of authorization checks. An attacker can obtain shipping labels for arbitrary orders, which contain sensitive information such as customer names, addresses, and pho...

EUVD-2026-107056

The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses...

CVE-2026-106932 Moloni < 5.0.14 - Subscriber+ Arbitrary Order Invoice Generation via genInvoice

The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authenticated user such as a Subscriber to generate fisca...

CVE-2026-106932 Moloni < 5.0.14 - Subscriber+ Arbitrary Order Invoice Generation via genInvoice

The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authenticated user such as a Subscriber to generate fisca...

CVE-2026-106932

The Moloni WordPress plugin versions prior to 5.0.14 is vulnerable to an authorization bypass. The plugin fails to perform capability or nonce checks on several authenticated AJAX actions, relying instead on the presence of a stored connection to an external invoicing provider. This allows any au...

CVE-2026-105998 Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization

The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features...

CVE-2026-105992 Ettrick Escape Room Booking < 1.3.1 - Unauthenticated Payment Confirmation Bypass

The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the payment provider before marking it paid and confirmed, allowing unauthenticated attackers to mark bookings as paid without paying...

EUVD-2026-107055

The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features...

CVE-2026-105992 Ettrick Escape Room Booking < 1.3.1 - Unauthenticated Payment Confirmation Bypass

The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the payment provider before marking it paid and confirmed, allowing unauthenticated attackers to mark bookings as paid without paying...

CVE-2026-105992

The Ettrick Escape Room Booking WordPress plugin versions prior to 1.3.1 is vulnerable to an unauthenticated payment confirmation bypass . The flaw exists because the plugin fails to verify a booking's payment status against the actual payment provider before marking the transaction as paid and c...

EUVD-2026-107054

The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriving them instead from values it exposes publicly, so an unauthenticated attacker can reconstruct an arbitrary booking's token, disclose that booking's persona...

CVE-2026-105998

The Booking Package WordPress plugin (versions before 1.7.31 ) is vulnerable to an unauthenticated subscription deactivation due to missing authorization and validity checks. An unauthenticated attacker can trigger a reset of the plugin's premium subscription state, effectively disabling the plug...

CVE-2026-105998 Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization

The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features...

PT-2026-120485

The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks...

PT-2026-120481

The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its...

PT-2026-120462

The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbitrary Productive Commerce WordPress plugin befo...

PT-2026-120461

The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators...

PT-2026-120471

The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor...

PT-2026-120466

The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and excerpt, allowing users with the Editor role and above to modify arbitrary posts of any type, including content they cannot otherwise edit such as...