WordPress Easy Appointments plugin < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appointments Listing vulnerability

Contributor+ Sensitive Information Disclosure via REST Appointments Listing vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Easy Appointments versions 4.0.1...

WordPress Broken Link Checker plugin < 2.4.12 - Unauthenticated RCE via Query Variable Injection vulnerability

Unauthenticated RCE via Query Variable Injection vulnerability discovered by Jakub Herman in WordPress Plugin Broken Link Checker versions 2.4.12...

WordPress TrueBooker Appointment Booking plugin < 1.2.7 - Unauthenticated Appointment and Payment Record Deletion via update_appointment_booked vulnerability

Unauthenticated Appointment and Payment Record Deletion via updateappointmentbooked vulnerability discovered by Erwan LR WPScan in WordPress Plugin TrueBooker versions 1.2.7...

WordPress TrueBooker Appointment Booking plugin < 1.2.7 - Unauthenticated Customer PII Disclosure via Multiple AJAX Actions vulnerability

Unauthenticated Customer PII Disclosure via Multiple AJAX Actions vulnerability discovered by Luka Zimonjic in WordPress Plugin TrueBooker versions 1.2.7...

WordPress TrueBooker Appointment Booking plugin < 1.2.7 - Unauthenticated Account Takeover via Multiple AJAX Actions vulnerability

Unauthenticated Account Takeover via Multiple AJAX Actions vulnerability discovered by Abdullah Kareem in WordPress Plugin TrueBooker versions 1.2.7...

WordPress TrueBooker Appointment Booking plugin < 1.2.7 - Unauthenticated Arbitrary Appointment Status Change via update_appointment_status vulnerability

Unauthenticated Arbitrary Appointment Status Change via updateappointmentstatus vulnerability discovered by Mokksh Parekh in WordPress Plugin TrueBooker versions 1.2.7...

WordPress WP Maps plugin < 4.9.8 - Subscriber+ Unlimited Autoloaded Option Creation vulnerability

Subscriber+ Unlimited Autoloaded Option Creation vulnerability discovered by Xanlar Agamalizade in WordPress Plugin WP Maps versions 4.9.8...

WordPress JetEngine plugin < 3.8.14 - Author+ Stored XSS via SVG Upload vulnerability

Author+ Stored XSS via SVG Upload vulnerability discovered by Erwan LR WPScan in WordPress Plugin JetEngine versions 3.8.14...

WordPress WP Directory Kit plugin < 1.5.7 - Unauthenticated User Email Disclosure via select_2_ajax_user vulnerability

Unauthenticated User Email Disclosure via select2ajaxuser vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Directory Kit versions 1.5.7...

WordPress W3 Total Cache plugin < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key vulnerability

Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key vulnerability discovered by Jakub Herman in WordPress Plugin W3 Total Cache versions 2.10.5...

WordPress TabaPay Gateway plugin <= 1.4.0 - Unauthenticated Account Takeover via Payment Callback vulnerability

Unauthenticated Account Takeover via Payment Callback vulnerability discovered by moonge in WordPress Plugin TabaPay Gateway versions = 1.4.0...

WordPress Product Shortlist plugin <= 1.0.4 - Unauthenticated SQL Injection via get_shortlisted_products vulnerability

Unauthenticated SQL Injection via getshortlistedproducts vulnerability discovered by João Ramos Maciel in WordPress Plugin Product Shortlist versions = 1.0.4...

WordPress Simple File List plugin <= 6.3.11 - Unauthenticated Stored XSS via File Description vulnerability

Unauthenticated Stored XSS via File Description vulnerability discovered by Ruwantha Harshamal in WordPress Plugin Simple File List versions = 6.3.11...

WordPress Simple File List plugin <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal vulnerability

Unauthenticated Arbitrary File Read and Move via Path Traversal vulnerability discovered by Sanjar Tulkinov in WordPress Plugin Simple File List versions = 6.3.11...

WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Unauthenticated Stored XSS via SVG File Upload vulnerability

Unauthenticated Stored XSS via SVG File Upload vulnerability discovered by Samdup Choephel in WordPress Plugin Booking calendar, Appointment Booking System versions = 3.2.36...

WordPress TenWeb Speed Optimizer plugin < 2.33.5 - Unauthenticated Stored XSS via Critical CSS Token Bypass vulnerability

Unauthenticated Stored XSS via Critical CSS Token Bypass vulnerability discovered by Jakub Herman in WordPress Plugin 10Web Booster – Website speed optimization, Cache & Page Speed optimizer versions 2.33.5...

WordPress Eventin plugin < 4.1.21 - Contributor+ User Role and Meta Modification via Speaker Creation vulnerability

Contributor+ User Role and Meta Modification via Speaker Creation vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WP Event SOlution versions 4.1.21...

WordPress Gift Cards For WooCommerce Pro plugin < 4.2.10 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Brandon Steed in WordPress Plugin Gift Cards For WooCommerce Pro versions 4.2.10...

CVE-2026-19435

The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content...

CVE-2026-18781

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server...