CVE-2026-61967

CVE-2026-61967 concerns an unauthenticated privilege-escalation vulnerability in the WordPress plugin miniorange OTP Verification (versions

EUVD-2026-57970

Unauthenticated Cross Site Scripting XSS in GeekyBot = 1.2.6 versions...

CVE-2026-61966 WordPress WPJAM Basic plugin <= 7.0.1 - SQL Injection vulnerability

Subscriber SQL Injection in WPJAM Basic = 7.0.1 versions...

CVE-2026-61960

Unauthenticated Cross Site Scripting XSS in WP Full Stripe Free = 8.5.0 versions...

CVE-2026-28189

Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.4 versions...

CVE-2026-28189

The CVE-2026-28189 entry concerns the WordPress Participants Database plugin version &lt;= 2.7.8.4, which is affected by an unauthenticated Arbitrary File Deletion vulnerability. The available records indicate the issue arises in this plugin series and can be triggered without authentication, wit...

EUVD-2026-57967

Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.4 versions...

CVE-2026-28188 WordPress Hydra Booking plugin <= 1.2.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Hydra Booking = 1.2.2 versions...

CVE-2026-28186

Subscriber Broken Access Control in Travelfic Toolkit = 1.5.1 versions...

CVE-2026-28187

The CVE-2026-28187 issue affects the WordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin, version

CVE-2026-28186 WordPress Travelfic Toolkit plugin <= 1.5.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in Travelfic Toolkit = 1.5.1 versions...

CVE-2026-28185

Unauthenticated Broken Authentication in Log in with Google = 1.4.2 versions...

CVE-2026-28185 WordPress Log in with Google plugin <= 1.4.2 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Log in with Google = 1.4.2 versions...

CVE-2026-28182 WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in AcyMailing SMTP Newsletter = 10.11.1 versions...

CVE-2026-28184

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

EUVD-2026-57959

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

CVE-2026-28176 WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

CVE-2026-28181 WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in AcyMailing SMTP Newsletter = 10.11.1 versions...

CVE-2026-28175

The connected documents confirm a vulnerability in the WordPress plugin Visitors Traffic Real Time Statistics, affected versions

CVE-2026-28175

Unauthenticated Cross Site Scripting XSS in Visitors Traffic Real Time Statistics = 8.11 versions...