CVE-2026-104797

The Advanced Form Integration plugin for WordPress (versions up to and including 2.9.0 ) is vulnerable to an Authentication Bypass and Privilege Escalation . The flaw exists in the adfoin_ultimatememberac_send_data function, which handles the Ultimate Member "Update Profile Field" action. Because...

CVE-2026-107645

The Blocksy Companion plugin for WordPress (versions up to and including 2.1.58 ) is vulnerable to an unauthenticated privilege escalation via the implement_user_registration() AJAX handler. The flaw exists because the plugin explicitly disables Dokan's vendor-registration nonce check and subsequ...

CVE-2026-96743

The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.4.1-RC2 . The root cause is insufficient input sanitization and output escaping of Table Field Values. This allows authenticated attackers with subscrib...

EUVD-2026-96036

The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Field Value in all versions up to, and including, 1.4.1-RC2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-107645 Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter

The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implementuserregistration AJAX handler explicitly disabling Dokan's vendor-registration nonce check via addfilter'dokanregisternoncecheck', 'returnfalse' an...

EUVD-2026-96038

The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implementuserregistration AJAX handler explicitly disabling Dokan's vendor-registration nonce check via addfilter'dokanregisternoncecheck', 'returnfalse' an...

CVE-2026-104797 Advanced Form Integration <= 2.9.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action

The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnerable to Authentication Bypass via Unverified Password Change in all versions up to, and including, 2.9.0 The adfoinultimatememberacsenddata function, which powers the Ultimate Member "Update Profile Field"...

CVE-2026-104898 Online Scheduling and Appointment Booking System <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.4 via the 'id, wpuserid' parameter due to missing validation on a user controlled key. This makes it possible for...

CVE-2026-104898

The Bookly plugin for WordPress (versions up to and including 28.4 ) is vulnerable to an Insecure Direct Object Reference (IDOR) due to a lack of validation on the id and wp_user_id parameters. Authenticated attackers with subscriber-level access and above can overwrite the WordPress account bind...

EUVD-2026-96035

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.4 via the 'id, wpuserid' parameter due to missing validation on a user controlled key. This makes it possible for...

CVE-2026-93883

The Advanced Classifieds & Directory Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone' parameter in all versions up to, and including, 3.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-104915

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible fo...

CVE-2026-104022

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the addchild function calling addrole'academystudent' on any existing account resolved from the...

EUVD-2026-96028

The Advanced Classifieds & Directory Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone' parameter in all versions up to, and including, 3.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-104022

The Academy LMS WordPress plugin (versions ≤ 4.0.3 ) is vulnerable to Privilege Escalation via the add_child() REST endpoint. The flaw occurs because the add_child() function calls add_role('academy_student') on an account identified by an attacker-supplied email parameter before the Store::link(...

EUVD-2026-96029

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the addchild function calling addrole'academystudent' on any existing account resolved from the...

CVE-2026-93883

The Advanced Classifieds & Directory Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.4.4 . The root cause is insufficient input sanitization and output escaping of the 'phone' parameter . An authenticated attacker with custom-level acc...

CVE-2026-104022 Academy LMS <= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add_child REST endpoint

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the addchild function calling addrole'academystudent' on any existing account resolved from the...

CVE-2026-93883 Advanced Classifieds & Directory Pro <= 3.4.4 - Authenticated (Custom+) Stored Cross-Site Scripting via 'phone' Parameter

The Advanced Classifieds & Directory Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone' parameter in all versions up to, and including, 3.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-104915 Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible fo...