CVE-2026-73343 WordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerability

Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...

EUVD-2026-60772

Unauthenticated Cross Site Scripting XSS in WP Multilang = 2.4.31 versions...

CVE-2026-73341

The WordPress RegistrationMagic plugin (versions

EUVD-2026-60771

Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...

CVE-2026-73341

Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...

CVE-2026-73339 WordPress Modern Events Calendar plugin < 7.35.0 - SQL Injection vulnerability

Unauthenticated SQL Injection in Modern Events Calendar 7.35.0 versions...

CVE-2026-73338

The WordPress Autopay plugin (versions ≤ 5.0.0) has an unauthenticated reflected/stored XSS flaw, exploitable via a network request with no authentication. CVSS 7.1 (HIGH) reflects low confidentiality/integrity/availability impact. Exploitation details are not provided; update to a patched versio...

CVE-2026-73190 WordPress WPDM – Premium Packages plugin <= 7.0.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WPDM – Premium Packages = 7.0.5 versions...

CVE-2026-73187

Unauthenticated SQL Injection in Sticky Chat Widget = 1.4.2 versions...

EUVD-2026-60938

Unauthenticated SQL Injection in Sticky Chat Widget = 1.4.2 versions...

CVE-2026-73187

The WordPress Sticky Chat Widget plugin (versions ≤ 1.4.2) contains an unauthenticated SQL Injection vulnerability, discovered by Nguyen Ba Khanh of HPT Vietnam Corporation. CVSS 3.1 scores it 9.3 (Critical) for network-exploitable high confidentiality impact. CISA SSVC rates it automatable with ...

CVE-2026-68568

WordPress MasterStudy LMS plugin (≤ 3.7.41) allows authenticated subscribers to escalate privileges, likely by bypassing capability checks in REST endpoints or AJAX handlers. CVSS 6.3 (medium) — network attack, low privileges required. No in-the-wild exploitation reported. Upgrade to a patched ve...

CVE-2026-68567 WordPress Convert Pro plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Convert Pro = 1.0.1 versions...

EUVD-2026-60933

Unauthenticated Broken Access Control in Appointment Hour Booking = 1.5.91 versions...

EUVD-2026-60932

Unauthenticated Cross Site Scripting XSS in Templately = 3.7.1 versions...

CVE-2026-66667

The WordPress Templately plugin (versions ≤ 3.7.1) contains an unauthenticated reflected/stored XSS vulnerability discovered by researcher daroo, rated CVSS 7.1 (HIGH). Attackers can inject malicious scripts via network requests requiring no authentication, potentially compromising user sessions ...

CVE-2026-66651

Unauthenticated Broken Access Control in MultiVendorX = 5.0.14 versions...

CVE-2026-66646

Contributor Cross Site Scripting XSS in WP Tab Widget = 1.2.11 versions...

CVE-2026-66645 WordPress Table Of Contents Block plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Table Of Contents Block = 1.5.0 versions...

CVE-2026-66645

The WordPress Table Of Contents Block plugin (≤1.5.0) allows authenticated contributors to inject cross-site scripting payloads. CVSS 3.1 scores 6.5 (Medium) with network attack vector and low privileges required. No exploit code or in-the-wild exploitation is documented in the provided materials.