CVE-2026-80072 User Registration & Membership < 5.2.8 - Unauthenticated Open Redirect via Login Redirect Parameters

The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing...

CVE-2026-86406 User Registration & Membership < 5.2.8 - Subscriber+ Privilege Escalation via Membership Purchase

The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role...

CVE-2026-88764

The Simple Membership WordPress plugin (versions before 4.7.8 ) contains a membership level escalation vulnerability. The flaw exists because the plugin fails to validate that the membership level provided in a PayPal payment notification matches the level configured for the specific paid payment...

CVE-2026-88764 Simple Membership < 4.7.8 - Subscriber+ Membership Level Escalation via PayPal Standard subsc_ref

The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment button, allowing members to pay for a lower-priced membership while being granted a higher, more privileged...

EUVD-2026-76953

The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing...

WordPress User Registration & Membership plugin < 5.2.8 - Unauthenticated Open Redirect vulnerability

Unauthenticated Open Redirect vulnerability discovered by Sai Praneeth Koti in WordPress Plugin User Registration versions 5.2.8...

CVE-2026-80071 User Registration & Membership < 5.2.8 - Author+ Privilege Escalation to Administrator

The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escala...

CVE-2026-77773

The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin (versions before 2.15.8 ) is vulnerable to unauthorized data disclosure. The flaw exists because one of its public AJAX actions fails to perform required capability, nonce, or session checks . This allows unauthenticated user...

CVE-2026-77773 Social Contact Form (FormyChat) < 2.15.8 - Unauthenticated Gravity Forms Entry Disclosure via formychat_get_gf_entry

The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session check on one of its public AJAX actions, allowing unauthenticated users to read the submitted entries of any form created with a supported third-party form Conta...

EUVD-2026-76952

The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escala...

CVE-2026-80071 User Registration & Membership < 5.2.8 - Author+ Privilege Escalation to Administrator

The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escala...

CVE-2026-80071

The User Registration & Membership WordPress plugin (versions before 5.2.8 ) is vulnerable to privilege escalation. The flaw exists because the plugin fails to properly restrict who can author a membership plan and lacks validation for the plans users attach to their own accounts. This allows aut...

Exploit for CVE-2026-77770

CVE-2026-77770 miniOrange 2FA CVE POC miniOrange 2FA WordPre...

PT-2026-90798

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to...

PT-2026-90795

The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment button, allowing members to pay for a lower-priced membership while being granted a higher, more privileged...

PT-2026-90963

Name of the Vulnerable Software and Affected Versions Hoo Companion WordPress plugin version 1.0.2 Description An import feature lacks authorization and validation checks and fails to sanitize submitted data before storing it as the active theme settings. This allows unauthenticated attackers to...

PT-2026-90965

The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing...

CVE-2026-85129: Improper Neutralization of Input During Web Page Generation

The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which wi...

CVE-2026-88995: Exposure of Sensitive Information to an Unauthorized Actor

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request, allowing unauthenticated users to retrieve other customers' appointment details, including free-text booking comments and contact information...

PT-2026-90790

The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session check on one of its public AJAX actions, allowing unauthenticated users to read the submitted entries of any form created with a supported third-party form Conta...