CVE-2026-73389 WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Kalles Addons = 1.0.6 versions...

CVE-2026-73390 WordPress Total Donations plugin <= 2.0.5 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Total Donations = 2.0.5 versions...

EUVD-2026-62391

Unauthenticated Privilege Escalation in Total Donations = 2.0.5 versions...

EUVD-2026-62390

Unauthenticated PHP Object Injection in Kalles Addons = 1.0.6 versions...

CVE-2026-73390

The Total Donations WordPress plugin (versions ≤ 2.0.5) has an unauthenticated privilege escalation vulnerability allowing network attackers to gain elevated access without credentials. CVSS 9.8 (Critical) reflects high confidentiality, integrity, and availability impact. No root cause, patch ver...

CVE-2026-73388 WordPress Nikstore Core plugin <= 1.5 - SQL Injection vulnerability

Unauthenticated SQL Injection in Nikstore Core = 1.5 versions...

CVE-2026-73386

The WordPress plugin "Track Geolocation Of Users Using Contact Form 7" through version 3.0.2 exposes sensitive data to unauthenticated users over the network (CVSS 7.5 HIGH, C:H/I:N/A:N). No exploitation status or remediation details are provided in the documents. Monitor for plugin updates. Patc...

CVE-2026-73384 WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 = 1.0.4 versions...

EUVD-2026-62385

Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 = 1.0.4 versions...

EUVD-2026-62384

Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...

CVE-2026-73354 WordPress SimplyRETS Real Estate IDX plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in SimplyRETS Real Estate IDX = 3.2.8 versions...

CVE-2026-73347

The WordPress TrueBooker appointment booking plugin (versions ≤ 1.2.6) allows unauthenticated remote attackers to escalate privileges, scoring CVSS 9.8 (CRITICAL). No patch version or exploit details are provided in the documents; users should upgrade once a patched release is available.

EUVD-2026-62381

Unauthenticated Privilege Escalation in TrueBooker = 1.2.6 versions...

EUVD-2026-62379

Unauthenticated Cross Site Scripting XSS in Global Gallery = 11.1.2 versions...

EUVD-2026-62380

Unauthenticated SQL Injection in NGG Smart Image Search 4.0.0 versions...

EUVD-2026-62373

Unauthenticated Cross Site Scripting XSS in Contest Gallery = 30.0.5 versions...

WordPress SmartSMTP plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Jorgson in WordPress Plugin SmartSMTP versions = 1.2.0...

WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Paymob for WooCommerce versions = 4.1.10...

WordPress WordPress Persistent Login plugin <= 3.1.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dutafi in WordPress Plugin WordPress Persistent Login versions = 3.1.0...

WordPress Advance Product Search plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by sequenceX0 in WordPress Plugin Advance Product Search versions = 1.4.8...