CVE-2026-19251 Ultimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile Activity

The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation...

CVE-2026-16983 Gutentor < 4.0.6 - Subscriber+ Password Protected Post Password Disclosure via REST API

The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role...

CVE-2026-19116 WP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit Form

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

CVE-2026-19251 Ultimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile Activity

The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation...

CVE-2026-16983 Gutentor < 4.0.6 - Subscriber+ Password Protected Post Password Disclosure via REST API

The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role...

EUVD-2026-69865

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

CVE-2026-16966

The Solace Extra WordPress plugin (versions before 1.7.0 ) is vulnerable to unauthenticated content disclosure. The flaw exists because one of its AJAX actions fails to perform proper authorization or post-status checks . This allows unauthenticated visitors to access and read content from non-pu...

CVE-2025-15664

The Ultimate Before After Image Slider & Gallery WordPress plugin (versions before 4.7.19 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly escape the slider's before-label value before a bundled client-side script re-injects it into the DOM. T...

CVE-2026-12865 Photo Gallery by 10Web < 1.8.44 - Reflected XSS via title and paged Parameters

The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages one on the Shortcode page, one on the Galleries/Albums list page, so an unauthenticated attacker can craft a link that, when opene...

CVE-2026-12526 Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...

WordPress Booking for Appointments and Events Calendar plugin < 2.4.9 - Unauthenticated Post-Booking Action Trigger vulnerability

Unauthenticated Post-Booking Action Trigger vulnerability discovered by Haitam Lazaar in WordPress Plugin Amelia versions 2.4.9...

CVE-2026-14215

The Booking for Appointments and Events Calendar WordPress plugin (Amelia) versions before 2.4.9 is vulnerable to an unauthenticated post-booking action trigger. The root cause is a lack of authentication or valid request token verification before executing the post-booking action chain . An unau...

CVE-2026-12526 Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...

CVE-2026-16966 Solace Extra < 1.7.0 - Unauthenticated Draft/Private Site Builder Content Disclosure via get_elementor_content

The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published draft, pending, private, and trashed Site Builder parts that WordPress would otherwise not ser...

CVE-2025-15664 BEAF < 4.7.19 - Author+ Stored XSS via Before Label

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser ...

EUVD-2025-210822

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser ...

EUVD-2026-69869

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by...

WordPress MotoPress Appointment Booking plugin < 2.4.8 - Unauthenticated Arbitrary Reservation Deletion vulnerability

Unauthenticated Arbitrary Reservation Deletion vulnerability discovered by Ahmed Hashim Ismael in WordPress Plugin MotoPress Appointment Booking versions 2.4.8...

EUVD-2026-69870

The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages one on the Shortcode page, one on the Galleries/Albums list page, so an unauthenticated attacker can craft a link that, when opene...

EUVD-2026-69868

The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an...