CVE-2026-18315

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the adminusercreatecus AJAX handler lacking any authentication o...

CVE-2026-32475 WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1...

WordPress GenesisExpo Core plugin <= 1.3.9 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Bonds in WordPress Plugin GenesisExpo Core versions = 1.3.9...

CVE-2026-73389

Unauthenticated PHP Object Injection in Kalles Addons = 1.0.6 versions...

CVE-2026-73390

Unauthenticated Privilege Escalation in Total Donations = 2.0.5 versions...

CVE-2026-73391

Unauthenticated SQL Injection in Total Donations = 2.0.5 versions...

CVE-2026-73364

Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...

CVE-2026-73384

Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 = 1.0.4 versions...

CVE-2026-73184

Unauthenticated Cross Site Scripting XSS in Global Gallery = 11.1.2 versions...

CVE-2026-66596

Unauthenticated Cross Site Scripting XSS in Newsletter = 9.3.3 versions...

CVE-2026-66668

Subscriber SQL Injection in Community by PeepSo = 9.0.5.2 versions...

CVE-2026-61986

Unauthenticated Cross Site Scripting XSS in Contest Gallery = 30.0.5 versions...

EUVD-2026-62392

Unauthenticated SQL Injection in Total Donations = 2.0.5 versions...

CVE-2026-73389 WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Kalles Addons = 1.0.6 versions...

CVE-2026-73390 WordPress Total Donations plugin <= 2.0.5 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Total Donations = 2.0.5 versions...

CVE-2026-73390

The Total Donations WordPress plugin (versions ≤ 2.0.5) has an unauthenticated privilege escalation vulnerability allowing network attackers to gain elevated access without credentials. CVSS 9.8 (Critical) reflects high confidentiality, integrity, and availability impact. No root cause, patch ver...

EUVD-2026-62391

Unauthenticated Privilege Escalation in Total Donations = 2.0.5 versions...

EUVD-2026-62390

Unauthenticated PHP Object Injection in Kalles Addons = 1.0.6 versions...

CVE-2026-73388 WordPress Nikstore Core plugin <= 1.5 - SQL Injection vulnerability

Unauthenticated SQL Injection in Nikstore Core = 1.5 versions...

CVE-2026-73386

The WordPress plugin "Track Geolocation Of Users Using Contact Form 7" through version 3.0.2 exposes sensitive data to unauthenticated users over the network (CVSS 7.5 HIGH, C:H/I:N/A:N). No exploitation status or remediation details are provided in the documents. Monitor for plugin updates. Patc...