CVE-2026-15149 WP Hotel Booking < 2.3.3 - Unauthenticated Payment Bypass via Price Manipulation

The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total are non-negative when placing a booking, and relies on client-controlled cart data, allowing unauthenticated users to create confirmed reservations for free or at an arbitrarily...

CVE-2026-15147 Five Star Restaurant Reservations < 2.7.23 - Unauthenticated Payment Bypass and Booking Confirmation via IDOR

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking, allowing unauthenticated attackers to mark...

CVE-2026-15147 Five Star Restaurant Reservations < 2.7.23 - Unauthenticated Payment Bypass and Booking Confirmation via IDOR

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking, allowing unauthenticated attackers to mark...

CVE-2026-10524 CoCart < 4.9.0 - Unauthenticated Arbitrary Price Manipulation

The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at...

CVE-2026-14936 Simple Membership < 4.7.7 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification

The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership, allowing unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayP...

CVE-2026-14831

Technical details are not publicly available in the provided documents; monitor for updates.

CVE-2026-14831 Easy Booking < 3.5.0 - Unauthenticated Minimum Booking Duration Bypass

The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking duration on the server side when adding to cart and calculating the booking price, allowing unauthenticated users to place below-minimum bookings and complete underpriced orders...

CVE-2026-14936

The CVE concerns the Simple Membership WordPress plugin prior to version 4.7.7, where PayPal IPN verification is not performed against the site’s configured merchant account before activating a membership. This allows unauthenticated users to activate or extend memberships using PayPal payments t...

CVE-2026-12901 GetPaid < 2.8.55 - Unauthenticated Worldpay Payment Bypass via Insufficient IPN Verification

The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications, allowing unauthenticated attackers to forge a notification that marks a pending invoice as paid without any payment being made...

CVE-2026-12901 GetPaid < 2.8.55 - Unauthenticated Worldpay Payment Bypass via Insufficient IPN Verification

The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications, allowing unauthenticated attackers to forge a notification that marks a pending invoice as paid without any payment being made...

CVE-2026-12501

CVE-2026-12501 affects the WP Travel Engine plugin for WordPress, prior to version 6.8.2. The vulnerability arises because the plugin does not verify that an incoming PayPal IPN is sent to the site’s merchant account, nor that the paid amount matches the order total, before marking a booking as p...

CVE-2026-12501 WP Travel Engine < 6.8.2 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver and Amount Verification

The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent to the site's configured merchant account, nor that the paid amount matches the order total, before marking a booking as paid, allowing unauthenticated attackers to mark bookin...

CVE-2026-15152 WP Hotel Booking < 2.3.2 - Unauthenticated PayPal Payment Bypass

The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without a...

CVE-2026-15152

The vulnerability affects WP Hotel Booking plugin for WordPress prior to 2.3.2. It allows unauthenticated users to mark bookings as fully paid without actual payment: the plugin fails to verify that a PayPal payment notification corresponds to a payment to the site’s merchant account and that the...

CVE-2026-15152 WP Hotel Booking < 2.3.2 - Unauthenticated PayPal Payment Bypass

The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without a...

CVE-2026-14225

The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire string, allowing users with contributor-level access to execu...

CVE-2026-14225 Easy Appointments < 3.12.28 - Contributor+ Shortcode Allowlist Bypass

The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire string, allowing users with contributor-level access to execu...

CVE-2026-14225 Easy Appointments < 3.12.28 - Contributor+ Shortcode Allowlist Bypass

The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire string, allowing users with contributor-level access to execu...

CVE-2026-14842 Events Made Easy < 3.1.2 - Unauthenticated Payment Bypass

The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowing unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-priced booking marked as fully paid...

CVE-2026-14812 Premium SEO - Unauthenticated Backdoor (Admin Creation / RCE / SSRF / Content Injection)

The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code execution, server-side request forgery and arbitrary front-end script/content injection, giving an unauthenticated attacker...