CVE-2026-65509

Unauthenticated Cross Site Scripting XSS in wpDataTables = 7.5.1 versions...

CVE-2026-65520

Unauthenticated SQL Injection in WP OAuth Server = 6.2.0 versions...

CVE-2026-61982

Unauthenticated Cross Site Scripting XSS in SiteGuard WP Plugin = 1.8.6 versions...

CVE-2026-32469

Unauthenticated Bypass Vulnerability in CAPTCHA 4WP = 7.6.0 versions...

CVE-2026-15246

The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber to obtain paid membership packages...

EUVD-2026-54088

The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail...

CVE-2026-3430 Creative Mail 1.6.5 - 1.6.9 - Unauthenticated SQLi

The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail...

CVE-2026-3430

CVE-2026-3430 affects the Creative Mail WordPress plugin versions 1.6.5–1.6.9. The issue is an unauthenticated SQL injection caused by not sanitizing/escaping a parameter before use in an SQL statement when handling abandoned cart emails. CVSS 3.1 metrics (from WPScan) indicate NETWORK attack vec...

CVE-2026-66711

CVE-2026-66711 concerns a Cross Site Scripting (XSS) vulnerability in the WordPress plugin WooCommerce Multilingual & Multicurrency, affecting versions up to and including 5.5.6. The connected documents confirm the affected product and the XSS vulnerability type but do not provide technical explo...

CVE-2026-66711 WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.6 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in WooCommerce Multilingual & Multicurrency = 5.5.6 versions...

CVE-2026-66709

The CVE-2026-66709 entry describes a Remote Code Execution (RCE) vulnerability in the WordPress CTX Feed plugin (CTX Feed)

CVE-2026-66710

Technical details are not publicly available in the provided documents. The CVE-2026-66710 entry states an Unauthenticated Local File Inclusion in WordPress e2pdf plugin

CVE-2026-66710 WordPress e2pdf plugin <= 1.32.40 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in e2pdf = 1.32.40 versions...

CVE-2026-66709 WordPress CTX Feed plugin <= 6.6.42 - Remote Code Execution (RCE) vulnerability

Shop manager Remote Code Execution RCE in CTX Feed = 6.6.42 versions...

CVE-2026-66708

CVE-2026-66708 affects the WordPress plugin Total Upkeep (versions

CVE-2026-66708 WordPress Total Upkeep plugin <= 1.17.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Total Upkeep = 1.17.2 versions...

CVE-2026-66707

CVE-2026-66707 describes an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Facebook for WooCommerce up to version 3.7.5. The CVE is documented across multiple sources (NVD, CVE List, EUVD, Patchstack). The vulnerability affects the plugin’s handling of input that...

CVE-2026-66706

CVE-2026-66706 affects the WordPress plugin “Subscribe to Comments” (versions

CVE-2026-66706 WordPress Subscribe to Comments plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability

Author Cross Site Scripting XSS in Subscribe to Comments = 2.3.1 versions...

EUVD-2026-53908

Unauthenticated Cross Site Scripting XSS in Facebook for WordPress = 5.2.1 versions...