CVE-2026-75797 AI Engine 3.3.3 - 3.7.1 - Subscriber+ Arbitrary File Read via 'url' Parameter

The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forwarding its contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and...

CVE-2026-74928 WP Project Manager 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation via Trello Import Routes

The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting...

CVE-2026-74851 Pods < 3.3.9.1 - Author+ RCE via Shortcode Display Callback

The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the restricted display-callback mode are affected, which is the...

EUVD-2026-66277

The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the restricted display-callback mode are affected, which is the...

CVE-2026-74930

The Project Manager WordPress plugin, versions 2.2.0 through 4.0.6 , is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to verify that the user requesting activity through a specific REST API route is the owner of that activity. This allows any authenticated user, ...

CVE-2026-74851 Pods < 3.3.9.1 - Author+ RCE via Shortcode Display Callback

The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the restricted display-callback mode are affected, which is the...

CVE-2026-19718 BlogVault, MalCare and WP Remote 5.16 - 6.62 - Unauthenticated Site Takeover via Connection Key Recovery

The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plugin before 6.65 do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote...

CVE-2026-19094 Tutor LMS < 4.0.6 - Unauthenticated SQLi via 'offset' and 'item_per_page' Parameters

The Tutor LMS WordPress plugin before 4.0.6 does not validate values used to build a database query, and does not restrict which template file a request may load, allowing unauthenticated users to inject SQL and to read question and answer content belonging to courses that are not publicly...

CVE-2026-19226

The Royal Addons for Elementor WordPress plugin, in versions prior to 1.7.1066 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the lack of validation for certain widget settings—specifically the Image Accordion Widget Effect Settings —before they are outputted inside an H...

CVE-2026-19094

The Tutor LMS WordPress plugin, specifically versions before 4.0.6 , is vulnerable to an unauthenticated SQL injection . The root cause is a failure to validate values used to build database queries and a lack of restrictions on which template files a request may load. Attackers can exploit this ...

WordPress Royal Addons for Elementor plugin < 1.7.1066 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin Royal Elementor Addons versions 1.7.1066...

EUVD-2026-66275

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

EUVD-2026-66272

The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price...

CVE-2026-19094 Tutor LMS < 4.0.6 - Unauthenticated SQLi via 'offset' and 'item_per_page' Parameters

The Tutor LMS WordPress plugin before 4.0.6 does not validate values used to build a database query, and does not restrict which template file a request may load, allowing unauthenticated users to inject SQL and to read question and answer content belonging to courses that are not publicly...

CVE-2026-16984

The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin (versions before 3.7.1 ) is vulnerable to an unauthenticated API secret disclosure . The root cause is a missing authorization check on a REST route that returns stored account data...

CVE-2026-19220

The Forminator Forms WordPress plugin in versions prior to 1.57.1 is vulnerable to unauthenticated multisite site creation and privilege escalation. The root cause is a failure to verify if site registration is enabled on the network before processing a site signup. This allows unauthenticated vi...

CVE-2026-19220 Forminator Forms < 1.57.1 - Unauthenticated Multisite Site Creation and Privilege Escalation

The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it...

CVE-2026-16986

The Booking Package WordPress plugin (versions before 1.7.25 ) is vulnerable to an unauthenticated price manipulation flaw. The root cause is a failure to validate the payment amount on the server-side against the stored service price; instead, the plugin derives the charge from attacker-supplied...

EUVD-2026-66273

The Tutor LMS WordPress plugin before 4.0.6 does not validate values used to build a database query, and does not restrict which template file a request may load, allowing unauthenticated users to inject SQL and to read question and answer content belonging to courses that are not publicly...

EUVD-2026-66271

The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secr...