CVE-2026-73384 WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 = 1.0.4 versions...

EUVD-2026-62385

Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 = 1.0.4 versions...

EUVD-2026-62384

Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...

CVE-2026-73354 WordPress SimplyRETS Real Estate IDX plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in SimplyRETS Real Estate IDX = 3.2.8 versions...

CVE-2026-73347

The WordPress TrueBooker appointment booking plugin (versions ≤ 1.2.6) allows unauthenticated remote attackers to escalate privileges, scoring CVSS 9.8 (CRITICAL). No patch version or exploit details are provided in the documents; users should upgrade once a patched release is available.

EUVD-2026-62381

Unauthenticated Privilege Escalation in TrueBooker = 1.2.6 versions...

EUVD-2026-62379

Unauthenticated Cross Site Scripting XSS in Global Gallery = 11.1.2 versions...

EUVD-2026-62380

Unauthenticated SQL Injection in NGG Smart Image Search 4.0.0 versions...

EUVD-2026-62373

Unauthenticated Cross Site Scripting XSS in Contest Gallery = 30.0.5 versions...

WordPress SmartSMTP plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Jorgson in WordPress Plugin SmartSMTP versions = 1.2.0...

WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Paymob for WooCommerce versions = 4.1.10...

WordPress WordPress Persistent Login plugin <= 3.1.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dutafi in WordPress Plugin WordPress Persistent Login versions = 3.1.0...

WordPress Advance Product Search plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by sequenceX0 in WordPress Plugin Advance Product Search versions = 1.4.8...

WordPress Form Maker by 10Web plugin <= 1.15.46 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Elijah Chia in WordPress Plugin Form Maker by 10Web versions = 1.15.46...

WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Cafe Pro versions 3.0.15...

exploit-CVE-2015-8351

Gwolle Guestbook WordPress Plugin RFI Exploit Dieses Python-Skript nutzt eine kritische Remote File Inclusion RFI-Schwachstelle im Gwolle Guestbook WordPress Plugin aus, die von einem nicht authentifizierten Angreifer ausgenutzt werden kann, um eine entfernte PHP-Datei einzubinden und beliebigen...

WordPress TaxoPress plugin <= 3.51.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Plugin TaxoPress versions = 3.51.0...

WordPress Total Donations plugin <= 2.0.5 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Total Donations versions = 2.0.5...

WordPress Total Donations plugin <= 2.0.5 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Total Donations versions = 2.0.5...

CVE-2026-15446

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...