CVE-2026-14545 TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Reset

The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site...

CVE-2026-14821

The Quiz and Survey Master QSM WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete arbitrary templates...

CVE-2026-14821 Quiz And Survey Master < 11.1.5 - Contributor+ Arbitrary Template Deletion

The Quiz and Survey Master QSM WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete arbitrary templates...

EUVD-2026-49698

The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site...

EUVD-2026-49700

The Quiz and Survey Master QSM WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete arbitrary templates...

CVE-2026-14821

The CVE-2026-14821 entry concerns the Quiz and Survey Master (QSM) WordPress plugin, affected up to version 11.1.4 (i.e., before 11.1.5). The root cause is a missing capability check when deleting output templates in the plugin, which permits users with contributor-level access and above to delet...

CVE-2026-14819

CVE-2026-14819 affects the WordPress plugin Event Tickets and Registration (prior to version 5.28.4). The issue is an improper escape of event titles in the ticket history log, enabling a Stored XSS attack that can execute in higher-privileged contexts on multisite installations. The vulnerabilit...

CVE-2026-14545

CVE-2026-14545 concerns the TrueBooker WordPress plugin prior to version 1.2.4. The issue is that password resets through a front-end account handler do not validate account ownership, allowing an unauthenticated attacker to set an arbitrary password on any account (including an administrator) an...

CVE-2026-16587

The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

EUVD-2026-49695

The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

EUVD-2026-49697

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletesticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticate...

CVE-2026-16585

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletesticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticate...

CVE-2026-16585 Better Messages <= 2.15.19 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal via 'file' Parameter

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletesticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticate...

CVE-2026-16587

Technical details for CVE-2026-16587 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-16811

Technical details for CVE-2026-16811 are not provided in connected documents; the initial description summarizes a time-based SQL injection via the 'orderby' parameter in ShopLentor

CVE-2026-16587 Advanced Form Integration <= 2.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary MailUp OAuth Token Overwrite via auth_redirect() Function

The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-16797

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible...

EUVD-2026-49694

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.3.7. This is due to missing or incorrect nonce validation on the processbulkaction function. This makes it possible for unauthenticated...

CVE-2026-15136

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.3.7. This is due to missing or incorrect nonce validation on the processbulkaction function. This makes it possible for unauthenticated...

CVE-2026-16797 ShopLentor <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'optionSection' Parameter

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible...