CVE-2026-28186

Subscriber Broken Access Control in Travelfic Toolkit = 1.5.1 versions...

CVE-2026-28174

Customer Sensitive Data Exposure in WP Event SOlution = 4.1.18 versions...

CVE-2026-28175

Unauthenticated Cross Site Scripting XSS in Visitors Traffic Real Time Statistics = 8.11 versions...

CVE-2026-28149

Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...

CVE-2026-28159

Subscriber Broken Access Control in Service Finder Booking = 6.2 versions...

CVE-2026-27999

Subscriber Broken Access Control in Tourfic = 2.23.1 versions...

CVE-2026-28003

Unauthenticated Cross Site Scripting XSS in Maspik – Spam blacklist = 2.9.1 versions...

CVE-2026-27543

Unauthenticated Privilege Escalation in MStore API = 4.20.0 versions...

CVE-2026-27538

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

CVE-2026-27380

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

CVE-2026-28002

CVE-2026-28002 affects the WordPress Booktics plugin up to version 1.0.22. The issue is an SQL Injection (blind) caused by improper neutralization of special elements in SQL commands, enabling potential unauthorized data access. No exploitation details or patches are provided in the documents; re...

EUVD-2026-57915

Unauthenticated Broken Access Control in InstaWP Connect = 0.1.3.7 versions...

EUVD-2026-57916

Unauthenticated Broken Access Control in User Registration = 5.2.6 versions...

EUVD-2026-57914

Donor Cross Site Scripting XSS in GiveWP 4.16.6 versions...

CVE-2026-73357 WordPress GiveWP plugin < 4.16.6 - Cross Site Scripting (XSS) vulnerability

Donor Cross Site Scripting XSS in GiveWP 4.16.6 versions...

CVE-2026-73349 WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in GiveWP 4.16.6 versions...

CVE-2026-73349

CVE-2026-73349 applies to the WordPress GiveWP plugin, pre-4.16.6. It is an unauthenticated broken access control vulnerability reported for GiveWP before version 4.16.6. The provided CVSSv3.1 metrics indicate network access, low attack complexity, no privileges required, with no confidentiality ...

CVE-2026-73353

CVE-2026-73353 — WordPress plugin Revolut Gateway for WooCommerce, versions

CVE-2026-73340 WordPress Featured Image from URL plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Featured Image from URL = 5.3.3 versions...

CVE-2026-73340

The CVE covers a Cross Site Scripting (XSS) vulnerability in the WordPress plugin Featured Image from URL , affecting versions