CVE-2026-104681 Envira Gallery < 1.16.2 - Author+ Non-Public Post Title and Excerpt Disclosure via Gallery REST Field

The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to view, allowing any user able to create and edit a gallery Author and above by default to disclose the title and excerpt of other...

CVE-2026-104682 Envira Gallery < 1.16.2 - Contributor Missing Authorization via Convert Gallery REST Route

The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that the requester can edit an arbitrary post they name rather than that they are allowed to create the Envira Gallery WordPress plugin before 1.16.2's own gallery...

CVE-2026-104684 Envira Gallery < 1.16.2 - Author+ IDOR via Shortcode

The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing authors to embed and expose other users' non-public gallery metadata to unauthenticated visitors...

WordPress Squadeno plugin < 1.12.0 - Trainer+ Section and Age Group Reassignment vulnerability

Trainer+ Section and Age Group Reassignment vulnerability discovered by Doston Abdullayev in WordPress Plugin Squadeno versions 1.12.0...

CVE-2026-106029

The WeddingCity Lite WordPress plugin, in versions through 1.0.4 , is vulnerable to an authorization bypass. The plugin fails to perform necessary authorization or validity checks before processing requests to delete content. This flaw allows unauthenticated attackers to permanently delete arbitr...

CVE-2026-104028

The Anton Extensions WordPress plugin, in versions up to and including 1.2.2 , is vulnerable to an unauthenticated arbitrary file upload. The flaw exists because the plugin fails to perform capability checks , nonce verification , or file-type validation when writing attacker-supplied content to ...

CVE-2026-94235

The MemberHero WordPress plugin (version 6.9 and below) is vulnerable to an arbitrary email sending flaw due to a missing capability and nonce check on an AJAX action. Specifically, the wpr_send_email_to_user function allows any authenticated user , such as a subscriber, to force the site to send...

CVE-2026-103694

The Mobile builder WordPress plugin (versions through 1.4.2 ) is vulnerable to a privilege escalation flaw. The plugin fails to properly restrict which user meta keys a logged-in user can update via one of its REST routes . This allows any user with a self-registered account, such as a customer, ...

EUVD-2026-96737

The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...

EUVD-2026-96738

The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied content to an attacker-chosen path, allowing unauthenticated attackers to upload arbitrary PHP files and achieve remote code...

CVE-2026-103305 Prenotazioni <= 1.7.5 - Unauthenticated Stored XSS via Settings Update

The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors...

CVE-2026-103694 Mobile builder <= 1.4.2 - Subscriber+ Privilege Escalation to Admin

The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, allowing any user with a self-registered account, such as a customer, to grant themselves the administrator role...

WordPress MemberHero plugin <= 6.9 - Subscriber+ Arbitrary Email Sending vulnerability

Subscriber+ Arbitrary Email Sending vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Simple User Registration versions = 6.9...

EUVD-2026-96736

The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, allowing any user with a self-registered account, such as a customer, to grant themselves the administrator role...

EUVD-2026-96735

The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors...

EUVD-2026-96698

MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the storeowner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only...

CVE-2026-108695 MultiVendorX through 5.0.19 Incorrect Authorization via Settings REST Endpoint

MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the storeowner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only...

PT-2026-110050

Name of the Vulnerable Software and Affected Versions Topcontent versions prior to 1.2.2 Description An issue exists where a request handler is not properly authorized and HTML sanitization is disabled before storing submitted content. This allows unauthenticated attackers to publish arbitrary...

PT-2026-110062

Name of the Vulnerable Software and Affected Versions WP Verify API versions prior to 1.0.1 Description Unauthenticated users can perform SQL injection attacks because the plugin fails to properly sanitize and escape the verify parameter before incorporating it into a SQL query. SQL injection is ...

PT-2026-110057

Name of the Vulnerable Software and Affected Versions WP-Partner versions prior to 1.2.2 Description An issue exists where the software fails to sanitize and escape the id parameter before incorporating it into a SQL query. This allows unauthenticated attackers to perform SQL injection, enabling...