CVE-2026-77007 HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated BigBlueButton API Secret Disclosure

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected...

EUVD-2026-68054

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected...

WordPress Appointment Booking Calendar Plugin and Scheduling Plugin plugin 1.5.6-1.6.2 - Unauthenticated Booking Price Manipulation vulnerability

Unauthenticated Booking Price Manipulation vulnerability discovered by Nguyen Phuoc Thinh - HPT Vietnam Corporation in WordPress Plugin BookingPress versions 1.5.6-1.6.2...

WordPress HEL Online Classroom: AI-powered Online Classrooms plugin <= 1.0.3 - Unauthenticated BigBlueButton API Secret Disclosure vulnerability

Unauthenticated BigBlueButton API Secret Disclosure vulnerability discovered by kimsunghoon in WordPress Plugin HEL Online Classroom: AI-powered Online Classrooms versions = 1.0.3...

CVE-2026-76586

The Appointment Booking Calendar Plugin and Scheduling Plugin for WordPress (versions 1.5.6-1.6.2 ) is vulnerable to an unauthenticated booking price manipulation via PayPal payment confirmation. The root cause is a failure to verify the amount actually paid against the server-side staged price d...

CVE-2026-76586 BookingPress 1.5.6 - 1.6.2 - Unauthenticated Booking Price Manipulation via PayPal Payment Confirmation

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a...

CVE-2026-77007

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin (versions

CVE-2026-76586 BookingPress 1.5.6 - 1.6.2 - Unauthenticated Booking Price Manipulation via PayPal Payment Confirmation

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a...

EUVD-2026-68052

The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media item...

CVE-2026-18234 MStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid...

CVE-2026-76547 Profile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/Export

The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by defaul...

EUVD-2026-68050

The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against any user viewing the affected content, including administrators. The shortco...

CVE-2026-19430

The Catfolders Document Gallery Pro WordPress plugin, in versions before 2.0.7 , contains an unauthenticated missing authorization vulnerability. The root cause is that certain REST API routes lack proper authorization, combined with a client-side forgeable token used to identify content. This al...

WordPress Catfolders Document Gallery Pro plugin < 2.0.7 - Unauthenticated Missing Authorization vulnerability

Unauthenticated Missing Authorization vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Catfolders Document Gallery Pro versions 2.0.7...

WordPress User Profile Builder plugin < 4.0.1 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Profile Builder versions 4.0.1...

CVE-2026-76548

The User Profile Builder WordPress plugin, in versions before 4.0.1 , is vulnerable to an authentication bypass in its front-end file upload feature . Because the plugin fails to properly restrict this feature, unauthenticated visitors can gain access to privileged capabilities. This allows attac...

CVE-2026-18234

The MStore API WordPress plugin (versions before 4.21.1 ) contains a vulnerability where it fails to verify if the order targeted by its wallet payment handling belongs to the requester. Additionally, the plugin fails to deduct the wallet balance for most payment methods. This allows any authenti...

CVE-2026-76547

The User Profile Builder WordPress plugin (versions before 4.0.1 ) is vulnerable to PHP Object Injection due to a lack of data type validation during configuration file imports. The vulnerability exists within a free add-on feature that is disabled by default; however, an Administrator (or Networ...

CVE-2026-18234 MStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid...

EUVD-2026-68048

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid...