CVE-2026-16250

The CVE concerns the Personal QR Message WordPress plugin (version

CVE-2026-16300

Affected software: ChamaWP WordPress plugin prior to version 1.0.13. Issue: password reset requests are not properly validated, enabling unauthenticated attackers to reset passwords for arbitrary users (including administrators) and potentially take over the site. Root cause: insufficient validat...

CVE-2026-16289 ProfileGrid < 6.0.0.0 - Subscriber+ Group Join Request Disclosure via pm_get_all_requests_from_group

The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks when listing a group's pending membership requests, allowing any authenticated user such as a Subscriber to disclose the names and request dates of the users awaiting approval to join any group, including privat...

EUVD-2026-52178

The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution...

CVE-2026-16297

The CVE-2026-16297 affects the Clearfy Cache WordPress plugin before version 2.4.3. Root cause: during unserialization of settings-import data, the plugin does not restrict allowed classes, enabling administrators to perform PHP Object Injection. This may lead to remote code execution if a gadget...

EUVD-2026-52181

The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover...

EUVD-2026-52176

The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard, allowing unauthenticated attackers to store arbitrary JavaScript that executes...

CVE-2026-16060

CVE-2026-16060 affects the WordPress plugin “Insert or Embed Articulate Content” up to version 4.3000000027. The root cause is incorrect validation of uploaded archives, relying on a bypassable check that lets an Editor-level user upload a server-executable file into a public directory, enabling ...

CVE-2026-16250 Personal QR Message <= 1.0 - Unauthenticated Arbitrary File Upload

The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution...

CVE-2026-16300 Chama < 1.0.13 - Unauthenticated Arbitrary User Password Reset

The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover...

CVE-2026-15383

The CVE-2026-15383 entry concerns the Blog Floating Button WordPress plugin (versions up to and including 1.4.20). Affected component: the visitor User-Agent header is not sanitized/escaped when stored via an unauthenticated tracking REST endpoint and later rendered unescaped in an administrator ...

CVE-2026-15383 Blog Floating Button <= 1.4.20 - Unauthenticated Stored XSS via User-Agent Header

The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...

CVE-2026-14557

The CVE concerns the SoftMarket — Digital Marketplace WordPress plugin (through version 1.0.0). Root cause: the authentication token is not properly validated in one branch of the email-verification flow. Impact: unauthenticated attackers can obtain a valid session as any verified user by supplyi...

EUVD-2026-52174

The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...

EUVD-2026-52172

The Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 does not verify that a user is authorized to access a referenced post before processing it and returning derived data, allowing users with contributor privileges to disclose data from private or draft posts they do not own...

EUVD-2026-52175

The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data including the email...

CVE-2026-15930

The CVE concerns the Simple Membership WordPress plugin prior to version 4.7.8. It does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, enabling an unauthenticated attacker to overwrite the primary administrator’s acco...

CVE-2026-15231 TaxoPress < 3.51.0 - Contributor+ Private Post Disclosure via IDOR

The Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 does not verify that a user is authorized to access a referenced post before processing it and returning derived data, allowing users with contributor privileges to disclose data from private or draft posts they do not own...

EUVD-2026-52171

The SoftMarket — Digital Marketplace WordPress plugin through 1.0.0 does not properly validate an authentication token in one branch of its email-verification flow, allowing unauthenticated attackers to obtain a valid session as any verified user by supplying only that user's ID...

CVE-2026-15231

The CVE-2026-15231 vulnerability affects the Tag, Category, and Taxonomy Manager WordPress plugin prior to version 3.51.0. The root cause is improper access control: the plugin does not verify that a user is authorized to access a referenced post before processing it and returning derived data. T...