CVE-2026-78272 WordPress Fluent Support Pro plugin <= 2.3.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in Fluent Support Pro = 2.3.1 versions...

CVE-2026-78269 WordPress Shared Files plugin <= 1.7.69 - Server Side Request Forgery (SSRF) vulnerability

Contributor Server Side Request Forgery SSRF in Shared Files = 1.7.69 versions...

CVE-2026-78269 WordPress Shared Files plugin <= 1.7.69 - Server Side Request Forgery (SSRF) vulnerability

Contributor Server Side Request Forgery SSRF in Shared Files = 1.7.69 versions...

CVE-2026-78258 WordPress Booking and Rental Manager plugin <= 2.7.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Booking and Rental Manager = 2.7.5 versions...

CVE-2026-78258 WordPress Booking and Rental Manager plugin <= 2.7.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Booking and Rental Manager = 2.7.5 versions...

CVE-2026-66623 WordPress Social Media & Share Icons plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Social Media & Share Icons = 2.9.9 versions...

CVE-2026-66623 WordPress Social Media & Share Icons plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Social Media & Share Icons = 2.9.9 versions...

CVE-2026-66623

CVE-2026-66623 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Social Media & Share Icons (also known as Ultimate Social Media Icons), affecting versions 2.9.9 and below . The vulnerability was discovered by Bonds and carries a CVSS 3.1 score of 7.1 (HIGH) ,...

CVE-2026-66584 WordPress 12 Step Meeting List plugin <= 3.19.16 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in 12 Step Meeting List = 3.19.16 versions...

CVE-2026-66599 WordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WPComplete = 2.9.5.6 versions...

CVE-2026-66599

CVE-2026-66599 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin WPComplete , affecting versions 2.9.5.6 and earlier . The vulnerability was discovered by Asim Alshaya and carries a CVSS v3.1 score of 7.1 (HIGH) with a scope change (CHANGED), reflecting the ab...

EUVD-2026-64830

Unauthenticated Cross Site Scripting XSS in 12 Step Meeting List = 3.19.16 versions...

CVE-2026-66599 WordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WPComplete = 2.9.5.6 versions...

CVE-2026-66584 WordPress 12 Step Meeting List plugin <= 3.19.16 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in 12 Step Meeting List = 3.19.16 versions...

CVE-2026-78291 WordPress RepairBuddy plugin <= 4.1223 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in RepairBuddy = 4.1223 versions...

WordPress Royal MCP plugin < 1.4.26 - Subscriber+ Insufficient Authorization in MCP Tools vulnerability

Subscriber+ Insufficient Authorization in MCP Tools vulnerability discovered by Alessandro Greco aka Aleff, Giovanbattista Ianni University of Calabria - UNICAL in WordPress Plugin Royal MCP versions 1.4.26...

WordPress WANotifier plugin < 2.6 - Subscriber+ LFI vulnerability

Subscriber+ LFI vulnerability discovered by Project Black in WordPress Plugin Notifier versions 2.6...

WordPress Booking Hub plugin <= 1.3.0 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Jamaal ahmed in WordPress Plugin Booking Hub versions = 1.3.0...

WordPress Content Protector (Passster) plugin < 4.3.9 - Unauthenticated Protected Content Disclosure via REST Path Allowlist Bypass vulnerability

Unauthenticated Protected Content Disclosure via REST Path Allowlist Bypass vulnerability discovered by Erwan LR WPScan in WordPress Plugin Passster versions 4.3.9...

WordPress Charitable plugin < 1.8.12 - Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass vulnerability

Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Charitable versions 1.8.12...