WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Legal Stone versions = 1.2.11...

WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Le Truffe versions = 1.1.7...

WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Marcell versions = 1.2.14...

WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Meals & Wheels versions = 1.1.13...

WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Orpheus versions = 1.8...

WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Filmax versions = 1.1.11...

WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Motorix versions = 1.11...

WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Nuts versions = 1.12...

CVE-2026-84166

The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request...

CVE-2026-84167

The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referenci...

CVE-2026-107791

The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site...

CVE-2025-15703

The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability Administrator by default to store a...

CVE-2026-84166 Hotel Booking <= 3.8 - Booking Order Creation, Deletion, and Modification via CSRF

The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request...

CVE-2026-84167 Hotel Booking <= 3.8 - Subscriber+ Booking Order PII Disclosure via IDOR

The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referenci...

CVE-2026-107791 WP Comment Cleaner 6.1 - 7.1 - Subscriber+ Bulk Comment Deletion via nav_delete_all_comment

The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site...

CVE-2025-15703 WP Job Openings < 4.0.0 - Admin+ Stored XSS

The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability Administrator by default to store a...

CVE-2026-84166

The Hotel Booking WordPress plugin versions through 3.8 is vulnerable to a Cross-Site Request Forgery (CSRF) flaw within its administrative booking order management component. The lack of proper CSRF protection allows an attacker to trick a logged-in administrator into performing unauthorized act...

CVE-2025-15703

The HireZoot WordPress plugin versions prior to 4.0.0 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to properly sanitise and escape one of the job specification settings before it is reflected on an admin-area settings page. This allows users with management cap...

EUVD-2025-211060

The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability Administrator by default to store a...

EUVD-2026-97244

The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site...