CVE-2026-19417 KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports...

CVE-2026-19782

The WPS Bidouille WordPress plugin before 1.33.5 exposes the wps_get_users AJAX action without authorisation checks, allowing any authenticated subscriber to enumerate all registered users' email addresses. CVSS 5.4 (Medium). No in-the-wild exploitation reported; upgrade to 1.33.5. https://wpscan...

EUVD-2026-62293

The SAML Single Sign On WordPress plugin before 5.4.7 does not verify the signature of a SAML response before storing the certificate it carries, and offers an administrator a one-click control that promotes that stored certificate to the site's trusted signing certificate, allowing unauthenticat...

CVE-2026-19055 ProSolution WP Client < 2.0.11 - Reflected XSS via Multiple Parameters

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator...

CVE-2026-19055

The ProSolution WP Client WordPress plugin before version 2.0.11 fails to sanitise and escape multiple parameters before reflecting them into HTML attributes on public pages, enabling reflected XSS exploitable against any visitor, including administrators. CVSS 3.1 scores this HIGH (7.1); no in-t...

EUVD-2026-62284

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records...

CVE-2026-19406

The Easy Appointments WordPress plugin before 4.0.1 exposes an appointment-listing REST endpoint without per-user scoping, letting contributor-level accounts read all site bookings including customer names, schedules, and statuses. Fix is to upgrade to version 4.0.1 or later. No in-the-wild explo...

EUVD-2026-62286

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator...

CVE-2026-19056 ProSolution WP Client < 2.0.11 - Reflected XSS via 'page' Parameter

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted...

CVE-2026-18937

The Broken Link Checker plugin before 2.4.12 accepts unrestricted query variables on sites using plain permalinks, letting unauthenticated users overwrite arbitrary PHP globals and achieve remote code execution when a classic editor is active. CVSS 9.0 (Critical). No exploitation evidence is prov...

CVE-2026-18776 TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Account Takeover via Multiple AJAX Actions

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow...

CVE-2026-18777

The TrueBooker WordPress plugin before 1.2.7 exposes an AJAX endpoint (update_appointment_status) with no authorisation checks, letting unauthenticated attackers change any appointment's status and trigger notification emails to customers. CVSS 3.1 scores 5.3 (Medium) for integrity impact only. R...

CVE-2026-18777 TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Arbitrary Appointment Status Change via update_appointment_status

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification emails to the affected customers...

CVE-2026-18778

The TrueBooker WordPress appointment-booking plugin (versions before 1.2.7) lacks authorization checks in several AJAX endpoints, allowing unauthenticated remote attackers to retrieve customer PII—name, email, phone, and postal address—via crafted requests. CVSS 3.1 scores this MEDIUM (5.3). No e...

EUVD-2026-62276

The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator...

CVE-2026-18031 TabaPay Gateway <= 1.4.0 - Unauthenticated Account Takeover via Payment Callback

The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator...

CVE-2026-17565 Animation Addons for Elementor < 2.7.2 - Unauthenticated Server-Side Request Forgery

The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back...

CVE-2026-17565

The Animation Addons for Elementor WordPress plugin before 2.7.2 is vulnerable to unauthenticated Server-Side Request Forgery (SSRF). An attacker supplies a value used to build the host of a server-side HTTP request, enabling the site to issue requests to internal hosts and return responses. CVSS...

CVE-2026-18051

The W3 Total Cache WordPress plugin before 2.10.5 fails to validate the page cache key request path, enabling unauthenticated attackers to perform path traversal and write or overwrite arbitrary files anywhere on the server, including .htaccess on Apache. CVSS 10.0 (Critical) reflects no auth, no...

CVE-2026-18202

JetEngine WordPress plugin versions before 3.8.14 add SVG to the site-wide list of allowed upload types without sanitising file contents. This allows users with the upload files capability (e.g., Authors) to upload an SVG file containing malicious JavaScript, resulting in a Stored Cross-Site Scri...