CVE-2026-77005 Code Monkeys Proposals <= 1.0.1 - Subscriber+ Arbitrary File Deletion via Path Traversal

The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file path before deleting a file, and does not check the capability of the user making the request, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can...

CVE-2026-75800

The Frontegg SAML SSO WordPress plugin, in versions through 1.0.1 , contains an unauthenticated account takeover vulnerability. The root cause is that the plugin fails to verify the signature or issuer of SAML authentication responses before establishing a user session. This flaw allows unauthent...

CVE-2026-77689

The Booking for Appointments and Events Calendar (Amelia) WordPress plugin, versions 9.0-9.8.0 , contains an unauthenticated payment bypass vulnerability. The root cause is a failure to verify that a payment was actually processed before recording a booking as paid; instead, the plugin trusts the...

CVE-2026-77705 Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the...

CVE-2026-75800 Frontegg SAML SSO <= 1.0.1 - Unauthenticated Account Takeover via Unverified SAMLResponse

The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, allowing unauthenticated attackers to log in as any user, including administrators, as well as to create arbitrary accounts...

EUVD-2026-76814

The WebTotem Backups WordPress plugin through 1.0.1 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the...

CVE-2026-77006 WebTotem Backups < 1.1.0 - Subscriber+ Arbitrary File Deletion via Path Traversal

The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the...

CVE-2026-77689 Amelia Pro 9.0 - 9.8 - Unauthenticated Payment Bypass

The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway...

CVE-2026-77006

The WebTotem Backups WordPress plugin, affecting versions before 1.1.0 (specifically through 1.0.1), contains a vulnerability allowing for arbitrary file deletion . The root cause is a failure to validate user-supplied file paths, a lack of user capability checks, and the discarding of internal C...

CVE-2026-83532 Custom Menu Wizard <= 3.3.1 - Contributor+ Stored XSS via Shortcode Attributes

The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed...

WordPress Custom Menu Wizard Widget plugin <= 3.3.1 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin Custom Menu Wizard Widget versions = 3.3.1...

EUVD-2026-76817

The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed...

CVE-2026-83532

The Custom Menu Wizard Widget WordPress plugin (versions through 3.3.1 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly sanitize and escape several shortcode attributes before they are rendered into HTML. This allows users with contributor-lev...

CVE-2026-83532 Custom Menu Wizard <= 3.3.1 - Contributor+ Stored XSS via Shortcode Attributes

The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed...

PT-2026-90564

Name of the Vulnerable Software and Affected Versions SAMO Forms WordPress plugin version 1.0.0 Description Insufficient sanitization and escaping of user input in several unauthenticated actions allows unauthenticated attackers to execute SQL injection attacks. SQL injection is a technique where...

PT-2026-90571

The Masteriyo LMS WordPress plugin before 3.4.1 does not sanitise and escape one of its course fields before outputting it back in the course editor, allowing users with the instructor role to perform Stored Cross-Site Scripting attacks against higher privileged users such as administrators...

PT-2026-90572

The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft...

PT-2026-90563

The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages by default, allowing unauthenticated visitors to obtain the email address of any user who has published content...

PT-2026-90569

The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in...

CVE-2026-87918: Improper Access Control

The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers, allowing unauthenticated attackers to make those third-party API calls, and consume the associated cost, using the site's own...