CVE-2026-13395 Bookly < 27.8 - Unauthenticated SQL Injection via staff_id

The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...

CVE-2026-13395 Bookly < 27.8 - Unauthenticated SQL Injection via staff_id

The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...

EUVD-2026-51014

The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into...

CVE-2026-14239 Tourmaster < 5.4.8 - Stored XSS via CSRF

The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into...

CVE-2026-13395

The CVE-2026-13395 entry concerns the WordPress plugin “Online Scheduling and Appointment Booking System” prior to version 27.8. The underlying issue is that a parameter from unauthenticated front-end booking requests is not properly sanitized or cast before being used in a SQL query, enabling un...

EUVD-2026-51012

The Essential Addons for Elementor WordPress plugin before 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCommerce products in its product-comparison feature, allowing unauthenticated users to disclose the title, price, and SKU of draft, pending, and private...

CVE-2026-13330

The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it adds to the list of allowed upload types, allowing users with the uploadfiles capability Author and above to upload files containing malicious JavaScript, leading to Stored...

CVE-2026-13143

The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paid, allowing unauthenticated attackers to forge a notification that flips an arbitrary pending booking to a paid and booked state at ...

EUVD-2026-51010

The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it adds to the list of allowed upload types, allowing users with the uploadfiles capability Author and above to upload files containing malicious JavaScript, leading to Stored...

CVE-2026-13145 WP Travel < 11.8.1 - Subscriber+ Booking PII Disclosure via IDOR

The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user, allowing any logged-in user to read another customer's booking details, including billing address information, by supplying an arbitrary booking...

CVE-2026-13178 Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation

The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...

CVE-2026-13178

The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...

EUVD-2026-51008

The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user, allowing any logged-in user to read another customer's booking details, including billing address information, by supplying an arbitrary booking...

CVE-2026-13143

The CVE-2026-13143 entry concerns the WP Travel WordPress plugin before 11.8.1. Vulnerability: it does not verify PayPal Instant Payment Notifications via the PayPal post-back handshake before marking a booking as paid, enabling an unauthenticated actor to forge a notification that flips any pend...

CVE-2026-13145

The CVE covers WP Travel for WordPress, pre-11.8.1. Affected: WP Travel WordPress plugin before 11.8.1. Issue: reading another user’s booking details (including billing address) via an IDOR on the customer account dashboard because the plugin does not verify that the requested booking belongs to ...

EUVD-2026-51007

The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paid, allowing unauthenticated attackers to forge a notification that flips an arbitrary pending booking to a paid and booked state at ...

CVE-2026-13178 Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation

The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...

CVE-2026-13330

The CVE affects the WordPress plugin Animation Addons for Elementor up to version 2.7.0. The issue is that the plugin does not sanitize uploaded SVG/SVGZ files, and erroneously treats them as allowed upload types. This enables users with the upload_files capability (Author and above) to upload fi...

CVE-2026-11881

CVE-2026-11881 affects the Fluent Forms WordPress plugin prior to 6.2.6. The vulnerability arises because a form field configuration setting is not sanitized/escaped before being output inside an inline script during form rendering, enabling Stored XSS. The issue can be exploited by a user with C...

CVE-2026-12500 WP Travel Engine < 6.8.2 - Unauthenticated Trip Difficulty Level Option Update

The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin before 6.8.2 option, allowing unauthenticated users to overwrite a site-wide WP Travel Engine WordPress plugin before 6.8.2 option the public...