CVE-2026-89288 Fast Courier 5.0.0 - 5.2.3 - Unauthenticated SQLi via 'wp_order_id' Parameter

The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...

EUVD-2026-100861

The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subscriber to read the email addresses of the repository's staff...

CVE-2026-86799

The Forms WordPress plugin (versions before 3.0.2 ) is vulnerable to unauthenticated stored XSS . The root cause is a failure to sanitise submitted form values on storage and a failure to escape those values before they are outputted on the form submissions screen within the administration dashbo...

CVE-2026-85000 EmbedPress < 4.6.8 - Unauthenticated YouTube API Quota Consumption and Database Bloating

The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credential-bearing request to a third-party API and stores attacker-controlled cache entries, allowing unauthenticated attackers to consume the si...

CVE-2026-85000 EmbedPress < 4.6.8 - Unauthenticated YouTube API Quota Consumption and Database Bloating

The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credential-bearing request to a third-party API and stores attacker-controlled cache entries, allowing unauthenticated attackers to consume the si...

CVE-2026-108064

The WP Encryption WordPress plugin versions before 7.8.8.2 contains a vulnerability in its SSL certificate-provisioning routine. Due to a lack of capability or nonce checks on the wple_auto_handler , unauthenticated users can overwrite the site's certificate private key and replace pending Let's ...

CVE-2026-108064 WP Encryption < 7.8.8.2 - Unauthenticated Certificate Private Key and ACME Order Replacement via wple_auto_handler

The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routine, allowing unauthenticated users to make the WP Encryption WordPress plugin before 7.8.8.2 overwrite the site's certificate...

CVE-2026-107320 GamiPress 7.9.5 - 8.0.5 - Unauthenticated Private Activity Log Disclosure

The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing unauthenticated users to retrieve the private activity logs of all users. This is an incomplete fix of CVE-2026-13450...

CVE-2026-107319

The GamiPress WordPress plugin before version 8.0.6 is vulnerable to an activity log disclosure due to a missing capability check and ownership verification on an authenticated AJAX action . This flaw allows any authenticated user, such as a Subscriber , to read arbitrary entries from the activit...

CVE-2026-107320

The GamiPress WordPress plugin, in versions 7.9.5 through 8.0.5 , contains a vulnerability where it fails to properly authorize access to private activity log entries . This flaw allows unauthenticated users to retrieve the private activity logs of all users on the site. This issue represents an ...

CVE-2026-107160

The LTL Freight Quotes – Old Dominion Edition WordPress plugin (versions before 4.2.19 ) is vulnerable to unauthenticated stored HTML injection . The flaw exists because the plugin fails to perform proper authorization checks or input sanitization before storing specific request values. This allo...

EUVD-2026-100891

The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing unauthenticated users to retrieve the private activity logs of all users. This is an incomplete fix of CVE-2026-13450...

CVE-2026-107178 Image Photo Gallery Final Tiles Grid < 3.6.16 - Contributor+ Stored XSS via 'lightboxOptions' Parameter

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes ...

CVE-2026-107158 LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated FreightDesk Integration Option Update via REST Route

The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that writes to the database, allowing unauthenticated users to modify some of the LTL Freight Quotes WordPress plugin before 4.2.19's stored settings...

CVE-2026-106646 Classified Listing < 6.1.1 - Subscriber+ Unattached Media Deletion and Modification via Gallery AJAX Handlers

The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item, allowing any authenticated user with a subscriber-level account to modify, corrupt or delete media-library...

CVE-2026-106469 Gutenverse Form < 3.0.11 - Contributor+ Stored XSS via SVG Icon

The Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon markup stored in its form blocks before it is decoded and inserted into the page in the browser, allowing authenticated users with Contributor-level access and above to store malicious SVG that executes JavaScript in th...

CVE-2026-106166 NEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_entry_update_id' Parameter

The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing...

CVE-2026-106099

The WP Data Access WordPress plugin (versions before 5.5.84 ) is vulnerable to unauthenticated sensitive data disclosure . The plugin fails to restrict its database table export action to authorized users, instead relying on a token that is publicly printed on the pages where tables are displayed...

CVE-2026-106469

The Gutenverse Form WordPress plugin versions before 3.0.11 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is a failure to sanitize SVG icon markup stored in form blocks before it is decoded and inserted into the browser page. This allows authenticated users with Contri...

CVE-2026-107158

The LTL Freight Quotes – Old Dominion Edition WordPress plugin, in versions prior to 4.2.19 , is vulnerable to an unauthenticated authorization bypass. The root cause is a lack of validation or authorization checks on a specific REST route that performs database writes. This flaw allows unauthent...