WordPress Starter Templates plugin <= 4.7.5 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Starter Templates versions = 4.7.5...

WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.21 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by sungbyeongchan in WordPress Plugin Flexible Quantity – Measurement Price Calculator for WooCommerce versions = 2.3.21...

WordPress Site Kit by Google plugin <= 1.186.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Site Kit by Google versions = 1.186.0...

WordPress Quiz And Survey Master plugin <= 11.2.5 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Adam Kahlon Adkali in WordPress Plugin Quiz And Survey Master versions = 11.2.5...

WordPress Deposits and Partial Payments for WooCommerce plugin <= 3.1.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Arif Shaikh in WordPress Plugin Deposits and Partial Payments for WooCommerce versions = 3.1.0...

WordPress UsersWP plugin <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion vulnerability

Authenticated Subscriber+ Arbitrary File Deletion vulnerability discovered by daroo in WordPress Plugin UsersWP versions = 1.2.70...

CVE-2026-84821

Unauthenticated Broken Access Control in WP Fast Total Search = 1.82.284 versions...

CVE-2026-84819

Unauthenticated Cross Site Scripting XSS in WPAdverts = 2.3.3 versions...

CVE-2026-81796

Authentication Bypass Using an Alternate Path or Channel vulnerability in WEN Solutions WP Travel wp-travel allows Password Recovery Exploitation.This issue affects WP Travel: from n/a through 12.0.3...

CVE-2026-81801

Subscriber Settings Change in WP-Stateless = 4.4.1 versions...

CVE-2026-81786

Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce = 1.2.2 versions...

CVE-2026-81787

Unauthenticated Broken Authentication in IMPress for IDX Broker = 3.3.0 versions...

CVE-2026-81275

Subscriber Arbitrary File Download in Youzify = 1.3.7 versions...

WordPress Booktics - Booking Calendar for Appointments and Service Businesses plugin <= 1.0.23 - Missing Authorization vulnerability

WordPress Booktics - Booking Calendar for Appointments and Service Businesses plugin = 1.0.23 - Missing Authorization vulnerability discovered by revblock in WordPress Plugin Booktics versions = 1.0.23...

CVE-2026-84821

CVE-2026-84821 affects the WP Fast Total Search WordPress plugin in versions

EUVD-2026-75536

Unauthenticated Broken Access Control in WP Fast Total Search = 1.82.284 versions...

CVE-2026-84821 WordPress WP Fast Total Search plugin <= 1.82.284 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Fast Total Search = 1.82.284 versions...

CVE-2026-84821 WordPress WP Fast Total Search plugin <= 1.82.284 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Fast Total Search = 1.82.284 versions...

CVE-2026-84816 WordPress WPCS plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WPCS = 1.3.2 versions...

CVE-2026-84819 WordPress WPAdverts plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WPAdverts = 2.3.3 versions...