CVE-2026-16977

The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection...

CVE-2026-16294

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a server-side request with it, allowing users with a role as low as Contributor to perform Server-Side Request Forgery attacks that can target...

CVE-2026-16066

The vulnerability is in the Welcart e-Commerce WordPress plugin before 2.11.34, where the product field is not sanitized or escaped before being output on product pages. This allows users with the Author role and above to inject arbitrary web scripts that execute in the browsers of visitors viewi...

CVE-2026-15388

Vulnerability summary (CVE-2026-15388): The Cookie Consent WordPress plugin (before 0.0.10) does not properly enforce the administrator-only capability check on its consent-settings REST routes. Consequently, these routes fall back to an authentication-only gate, allowing any authenticated user (...

EUVD-2026-57087

The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's...

EUVD-2026-57085

The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages installed through its remote management interface, nor protect those requests against replay, allowing an attacker able to obtain or replay a valid signed management request to install and execute...

CVE-2026-16253

The CVE-2026-16253 affects the Total Upkeep WordPress plugin prior to version 1.17.3. The vulnerability arises because the plugin does not adequately protect the secret used to authorize its backup-restore functionality, exposing it to unauthenticated users. This can lead to disclosure of sensiti...

CVE-2026-16066

The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page...

CVE-2026-16253

The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's...

EUVD-2026-57083

The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element...

CVE-2026-16051

The CVE-2026-16051 entry concerns the wpmudev-updates WordPress plugin (pre-5.0.1). The vulnerability arises because remote management interface packages are not integrity-checked and requests are not protected against replay. An attacker who can obtain or replay a valid signed management request...

CVE-2026-16051

The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages installed through its remote management interface, nor protect those requests against replay, allowing an attacker able to obtain or replay a valid signed management request to install and execute...

CVE-2026-15388

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent...

CVE-2026-14925

The CVE-2026-14925 affects the Import WP WordPress plugin (versions before 2.14.23). The issue is an missing authorization check on an export-file download handler, allowing unauthenticated attackers to download export files created by administrators. These files may contain personal user data (e...

EUVD-2026-57080

The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission...

CVE-2026-13177

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers...

CVE-2026-13613

The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injection...

EUVD-2026-57074

The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records...

EUVD-2026-57076

The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details...

CVE-2026-13171

The CVE-2026-13171 entry concerns the Eventin WordPress plugin prior to version 4.1.20. The underlying issue is a missing authorization check on the waiting-list registration handler, enabling unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order r...