WordPress Import and export users and customers plugin <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting vulnerability

Authenticated Custom+ Stored Cross-Site Scripting vulnerability discovered by Luca Laytynher LyT in WordPress Plugin Import and export users and customers versions = 2.4.5...

WordPress Kirki – Freeform Page Builder, Website Builder & Customizer plugin <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting vulnerability

Authenticated Custom+ Stored Cross-Site Scripting vulnerability discovered by Pham Duc Anh in WordPress Plugin Kirki versions = 6.2.0...

WordPress Forms plugin < 3.0.2 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Forms versions 3.0.2...

WordPress affiliate-toolkit plugin < 3.9.1 - Contributor+ RCE vulnerability

Contributor+ RCE vulnerability discovered by Artus KG in WordPress Plugin affiliate-toolkit versions 3.9.1...

WordPress Ultimate Multisite plugin < 2.17.2 - Unauthenticated LFI vulnerability

Unauthenticated LFI vulnerability discovered by hanzzly Farhan Auliya Abrar in WordPress Plugin Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform versions 2.17.2...

CVE-2026-82844

The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its...

CVE-2026-82844

The WPForms Lite WordPress plugin (versions 1.10.0.1 - 2.0.2.1 ) contains a vulnerability where it fails to perform server-side verification of completed payments when using the PayPal Commerce gateway . This allows unauthenticated visitors to submit paid forms without making an actual payment. C...

CVE-2026-88998 Tickera < 3.6.0.4 - Unauthenticated Order Payment Bypass via 2Checkout IPN

The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature does not cover the order or the amount, allowing unauthenticated attackers to forge a payment confirmation and mark arbitrary orders as paid without...

CVE-2026-103308 Visma Pay for WooCommerce < 1.2.2 - Unauthenticated Payment Bypass and Order Data Disclosure via Gateway Return Endpoint

The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on a merchant secret that is empty on a store which has not entered its credentials, allowing unauthenticated attackers to mark arbitrary orders as paid and to...

CVE-2026-101301 WPCode 2.0.0 - 2.3.9 - Unauthenticated Snippet Suppression via Safe Mode Bypass

The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing unauthenticated visitors to disable all of the site's automatically inserted snippets for their own requests...

CVE-2026-101301 WPCode 2.0.0 - 2.3.9 - Unauthenticated Snippet Suppression via Safe Mode Bypass

The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing unauthenticated visitors to disable all of the site's automatically inserted snippets for their own requests...

CVE-2026-101301

The WPCode WordPress plugin (versions 2.0.0 through 2.3.9) is vulnerable to unauthenticated snippet suppression. The root cause is a failure to correctly verify if a request is genuinely for the login screen before entering snippet safe mode . This allows unauthenticated visitors to disable all o...

WordPress GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Sawyer in WordPress Plugin GeoDirectory versions = 2.8.190...

CVE-2026-94254

The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when totals are recalculated during checkout, allowing unauthenticated attackers to place orders for any purchasable product at a price of their own choosing...

CVE-2026-94261

The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns that order, allowing unauthenticated attackers holding one valid transaction identifier from a payment of their own to mark arbitra...

CVE-2026-96904

The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass the ownership check on the ad submission page and read the private contact email stored on any...

CVE-2026-85345

The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an existing host-based restriction fails to cover all cases, allowing users with Contributor-level access and above to perform Server-Side...

CVE-2026-107320

The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing unauthenticated users to retrieve the private activity logs of all users. This is an incomplete fix of CVE-2026-13450...

CVE-2026-105969

The CodeAtoZ B2B Suite for WooCommerce WordPress plugin before 1.6.1 does not properly restrict access to guest-submitted quotes, allowing unauthenticated users to retrieve another guest's quote, including the buyer's name, email address and requested line items, by supplying an enumerable...

CVE-2026-105975

The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives the payment result from client-supplied parameters, allowing unauthenticated attackers to mark payment records as paid, destroy genuine payment...