CVE-2026-66595 WordPress WP Data Access plugin <= 5.5.80 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Data Access = 5.5.80 versions...

EUVD-2026-63338

Unauthenticated Broken Access Control in WP Data Access = 5.5.80 versions...

CVE-2026-66595

The WordPress WP Data Access plugin (versions ≤ 5.5.80) has an unauthenticated broken access control flaw allowing remote, no-auth access to restricted functionality with HIGH confidentiality impact (CVSS 5.9). No patch version or exploitation details are provided; monitor Patchstack's advisory f...

CVE-2026-66593

Unauthenticated SQL Injection in Security & Malware scan by CleanTalk = 2.184 versions...

EUVD-2026-63336

Unauthenticated SQL Injection in Security & Malware scan by CleanTalk = 2.184 versions...

CVE-2026-66593 WordPress Security & Malware scan by CleanTalk plugin <= 2.184 - SQL Injection vulnerability

Unauthenticated SQL Injection in Security & Malware scan by CleanTalk = 2.184 versions...

CVE-2026-66592 WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.11 - SQL Injection vulnerability

Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.11 versions...

CVE-2026-66590 WordPress Tagembed plugin <= 7.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Tagembed = 7.4 versions...

CVE-2026-66582 WordPress TranslatePress plugin <= 3.3.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in TranslatePress = 3.3.2 versions...

CVE-2026-28150 WordPress Golo Framework plugin < 1.7.5 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Golo Framework 1.7.5 versions...

CVE-2026-66581 WordPress JetEngine plugin <= 3.8.14.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.14.1 versions...

CVE-2025-15637

Unauthenticated Local File Inclusion in Shuffle = 1.8 versions...

EUVD-2025-210754

Unauthenticated Local File Inclusion in Shuffle = 1.8 versions...

WordPress EWWW Image Optimizer plugin <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content vulnerability discovered by UKO - Korea univ. in WordPress Plugin EWWW Image Optimizer versions = 8.7.3...

WordPress TrueBooker plugin <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter vulnerability

Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebookerwpuserid' Parameter vulnerability discovered by Décio Brandão in WordPress Plugin TrueBooker versions = 1.2.6...

WordPress WP Data Access plugin < 5.5.79 - Unauthenticated Sensitive Data Disclosure via Autocomplete Column Authorization Bypass vulnerability

Unauthenticated Sensitive Data Disclosure via Autocomplete Column Authorization Bypass vulnerability discovered by Farid Narimanov in WordPress Plugin WP Data Access versions 5.5.79...

WordPress Salon Booking System - Free Version plugin < 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering vulnerability

WordPress Salon Booking System - Free Version plugin 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Salon booking system versions 10.30.34...

WordPress Saitama Addon Pack plugin <= 1.0.8 - Contributor+ Stored XSS via Post Meta vulnerability

Contributor+ Stored XSS via Post Meta vulnerability discovered by testoun in WordPress Plugin Saitama Addon Pack versions = 1.0.8...

WordPress WP Custom HTML Pages plugin <= 0.6.2 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin WP Custom HTML Page versions = 0.6.2...

WordPress LogMyTrip plugin <= 1.9 - Unauthenticated SQL Injection via 'tid' Cookie vulnerability

Unauthenticated SQL Injection via 'tid' Cookie vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin LogMyTrip versions = 1.9...