CVE-2026-59546

Subscriber Broken Authentication in Hide My WP Ghost = 7.0.06 versions...

CVE-2026-59539 WordPress Paid Member Subscriptions plugin <= 3.0.7 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Paid Member Subscriptions = 3.0.7 versions...

EUVD-2026-49214

Unauthenticated SQL Injection in GamiPress = 7.9.7 versions...

CVE-2026-59535

CVE-2026-59535 affects WordPress Thrive Product Manager plugin

CVE-2026-59534

The CVE-2026-59534 entry concerns the WordPress plugin Post My CF7 Form (versions

CVE-2026-59534 WordPress Post My CF7 Form plugin <= 6.2.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Post My CF7 Form = 6.2.0 versions...

CVE-2026-59532 WordPress Booking and Rental Manager plugin <= 2.7.2 - Price Manipulation vulnerability

Unauthenticated Other Vulnerability Type in Booking and Rental Manager = 2.7.2 versions...

CVE-2026-59531

CVE-2026-59531 applies to the WordPress Falcon – WordPress Optimizations & Tweaks plugin, version

CVE-2026-59532 WordPress Booking and Rental Manager plugin <= 2.7.2 - Price Manipulation vulnerability

Unauthenticated Other Vulnerability Type in Booking and Rental Manager = 2.7.2 versions...

CVE-2026-59532

The CVE concerns the WordPress Booking and Rental Manager plugin for WooCommerce (versions

CVE-2026-59531 WordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.10.0 - Unknown vulnerability

Unauthenticated Unknown in Falcon – WordPress Optimizations & Tweaks = 2.10.0 versions...

CVE-2026-59530 WordPress Stripe For WooCommerce plugin <= 4.0.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Stripe For WooCommerce = 4.0.7 versions...

CVE-2026-59529 WordPress Ebook Store plugin <= 6.19 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Ebook Store = 6.19 versions...

Exploit for CVE-2026-9830

CVE-2026-9830 Investigation Overview This directory contai...

CVE-2026-9830

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other...

CVE-2026-14820

The Quiz and Survey Master QSM WordPress plugin before 11.1.3 does not implement rate limiting or standard failed-login auditing on its front-end credential-check functionality and returns distinct responses for valid and invalid accounts, allowing unauthenticated attackers to enumerate valid...

CVE-2026-14203

The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the...

CVE-2026-13726

The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request...

CVE-2026-14235

The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked download key can repeatedly download a role-...

CVE-2026-14568

The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 does not correctly verify ownership before deleting an attachment, allowing unauthenticated attackers to permanently delete author-less attachments su...