CVE-2026-78152

The SureRank SEO WordPress plugin, versions 1.6.2 through 1.10.0 , contains a vulnerability that allows unauthenticated visitors to obtain the registered account email addresses of users who have published content. This occurs because the plugin fails to exclude these email addresses from the str...

CVE-2026-80494

The Yogeta WP Cloud WordPress plugin (versions through 1.0 ) is vulnerable to an unauthenticated arbitrary file download due to a lack of validation on user-supplied file paths. The application passes these paths to a file-read function on a public endpoint that lacks proper authorization checks....

EUVD-2026-76809

The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages by default, allowing unauthenticated visitors to obtain the email address of any user who has published content...

EUVD-2026-76808

The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated actions, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-77752 Temporary Login Without Password 1.5 - 1.9.8 - Multisite Subsite Admin+ Network Super Admin Privilege Escalation

The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rights, allowing an administrator of a single site on a multisite network to take over the whole...

CVE-2026-81090 Gpx2Graphics <= 0.3 - Arbitrary File Upload via CSRF

The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when handling file uploads, nor validate the type of the uploaded file, allowing attackers to make a logged-in administrator upload arbitrary files such as PHP via a CSRF attack, leading to Remote Code Execution...

CVE-2026-80491

The SAMO Forms WordPress plugin, version 1.0.0 and below, is vulnerable to SQL injection because it fails to properly sanitise and escape user input. This flaw exists within several unauthenticated actions , allowing remote attackers to execute unauthorized SQL queries. The vulnerability has been...

CVE-2026-81090

The Gpx2Graphics WordPress plugin (versions ↜ 0.3 ) contains an Arbitrary File Upload vulnerability. The software fails to perform CSRF checks during file uploads and lacks file type validation . This allows an attacker to trick a logged-in administrator into uploading arbitrary files, such as PH...

CVE-2026-78152 SureRank 1.6.2 - 1.10.0 - Unauthenticated Author Email Disclosure via Person Schema

The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages by default, allowing unauthenticated visitors to obtain the email address of any user who has published content...

WordPress SureRank SEO plugin 1.6.2-1.10.0 - Unauthenticated Author Email Disclosure vulnerability

Unauthenticated Author Email Disclosure vulnerability discovered by Vaibhav Narkhede in WordPress Plugin SureRank versions 1.6.2-1.10.0...

EUVD-2026-76782

The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-supplied file path before passing it to a file-read function on a public endpoint that lacks any authorization check, allowing unauthenticated attackers to download arbitrary files from the server, including files containin...

EUVD-2026-76783

The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when handling file uploads, nor validate the type of the uploaded file, allowing attackers to make a logged-in administrator upload arbitrary files such as PHP via a CSRF attack, leading to Remote Code Execution...

CVE-2026-80491 SAMO Forms <= 1.0.0 - Unauthenticated SQLi

The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated actions, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-81090 Gpx2Graphics <= 0.3 - Arbitrary File Upload via CSRF

The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when handling file uploads, nor validate the type of the uploaded file, allowing attackers to make a logged-in administrator upload arbitrary files such as PHP via a CSRF attack, leading to Remote Code Execution...

CVE-2026-77705 Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the...

CVE-2026-77005 Code Monkeys Proposals <= 1.0.1 - Subscriber+ Arbitrary File Deletion via Path Traversal

The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file path before deleting a file, and does not check the capability of the user making the request, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can...

CVE-2026-77006 WebTotem Backups < 1.1.0 - Subscriber+ Arbitrary File Deletion via Path Traversal

The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the...

EUVD-2026-76814

The WebTotem Backups WordPress plugin through 1.0.1 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the...

CVE-2026-77705 Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the...

CVE-2026-77005 Code Monkeys Proposals <= 1.0.1 - Subscriber+ Arbitrary File Deletion via Path Traversal

The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file path before deleting a file, and does not check the capability of the user making the request, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can...