EUVD-2026-96768

The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST endpoints, and does not escape the values stored through them before outputting them in a public page, allowing unauthenticated users to inject arbitrary web scripts that will execute in the...

EUVD-2026-96767

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role...

EUVD-2026-96764

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to create and overwrite arbitrary WordPress options with request data, which can take the site offline and deactivate all of its Insurify WordPress...

CVE-2026-86717 Insurify <= 1.0 - Unauthenticated Arbitrary Option Deletion via removeimg_popup

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role...

CVE-2026-86706 Quick quotes <= 1.0.0 - Unauthenticated Integer-Value Option Update

The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose which option is written, allowing unauthenticated users to alter arbitrary site settings and to make the site unavailable...

CVE-2026-85121 Insurify <= 1.0 - Unauthenticated Arbitrary Option Creation and Overwrite via saveemailtemplatedesign

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to create and overwrite arbitrary WordPress options with request data, which can take the site offline and deactivate all of its Insurify WordPress...

CVE-2026-86798 HootBoard <= 3.1.4 - Unauthenticated Stored XSS via Board Configuration REST Endpoint

The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST endpoints, and does not escape the values stored through them before outputting them in a public page, allowing unauthenticated users to inject arbitrary web scripts that will execute in the...

CVE-2026-85121

The Insurify WordPress plugin, in versions through 1.0 , is vulnerable to unauthenticated arbitrary option creation and overwriting. The root cause is a lack of authorisation and nonce checks on an AJAX action, specifically identified in the context of saveemailtemplatedesign. An attacker can use...

EUVD-2026-96759

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-84734 Mindstien Quick Login <= 1.0 - Unauthenticated Administrator Account Takeover via 'mql_pass' Parameter

The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress...

CVE-2026-84734

The Mindstien Quick Login WordPress plugin (version 1.0 and below ) is vulnerable to an unauthenticated administrator account takeover . The root cause is a failure to correctly validate a request value against the visitor's session before authentication, specifically involving the 'mql_pass' par...

CVE-2026-84734 Mindstien Quick Login <= 1.0 - Unauthenticated Administrator Account Takeover via 'mql_pass' Parameter

The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress...

CVE-2026-84737 Freeton WP <= 1.0.0 - Unauthenticated Account Takeover via 'secod' Parameter

The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated attackers to log in as any user whose email address they know, including administrators...

EUVD-2026-96751

The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-81649 Fundiin <= 3.4.0 - Unauthenticated Payment Gateway Settings Update and Credential Disclosure

The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is identical on every installation, allowing unauthenticated attackers to disclose the store's payment credentials and customer ord...

CVE-2026-14854 WooCommerce Bookings < 3.11.0 - Unauthenticated Denial of Service

The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request...

CVE-2026-107694 Dokan < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure via Commission REST Endpoint

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that the vendor a commission calculation is requested for is the requesting vendor, allowing vendors to disclose the commission rate and fixed fee the marketplace administrator...

WordPress Robo Gallery plugin < 5.2.6 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Robo Gallery versions 5.2.6...

CVE-2026-106029 WeddingCity Lite <= 1.0.4 - Unauthenticated Arbitrary Post and Attachment Deletion

The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide...

CVE-2026-104681 Envira Gallery < 1.16.2 - Author+ Non-Public Post Title and Excerpt Disclosure via Gallery REST Field

The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to view, allowing any user able to create and edit a gallery Author and above by default to disclose the title and excerpt of other...