CVE-2026-86717

The Insurify WordPress plugin (versions through 1.0 ) is vulnerable to unauthenticated arbitrary option deletion . This is caused by a lack of authorization and nonce checks on one of its AJAX actions, specifically identified as removeimg_popup. An attacker can exploit this to delete arbitrary Wo...

CVE-2026-86798 HootBoard <= 3.1.4 - Unauthenticated Stored XSS via Board Configuration REST Endpoint

The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST endpoints, and does not escape the values stored through them before outputting them in a public page, allowing unauthenticated users to inject arbitrary web scripts that will execute in the...

CVE-2026-86706 Quick quotes <= 1.0.0 - Unauthenticated Integer-Value Option Update

The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose which option is written, allowing unauthenticated users to alter arbitrary site settings and to make the site unavailable...

CVE-2026-86717 Insurify <= 1.0 - Unauthenticated Arbitrary Option Deletion via removeimg_popup

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role...

CVE-2026-85118 AI Content Generator Marketing <= 1.0.0 - Unauthenticated Privilege Escalation via Arbitrary Option Update and Deletion

The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site...

EUVD-2026-96763

The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site...

CVE-2026-84734 Mindstien Quick Login <= 1.0 - Unauthenticated Administrator Account Takeover via 'mql_pass' Parameter

The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress...

CVE-2026-84737 Freeton WP <= 1.0.0 - Unauthenticated Account Takeover via 'secod' Parameter

The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated attackers to log in as any user whose email address they know, including administrators...

CVE-2026-85118

The AI Content Generator Marketing WordPress plugin (versions through 1.0.0 ) is vulnerable to unauthenticated privilege escalation. The root cause is a failure to enforce nonce or capability checks on specific AJAX actions , which allows unauthenticated users to update or delete arbitrary WordPr...

EUVD-2026-96762

The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated attackers to log in as any user whose email address they know, including administrators...

EUVD-2026-96761

The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress...

CVE-2026-84260

The click5 CRM add-on to the Gravity Forms WordPress plugin (versions through 1.0.3 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to sanitize and escape content submitted through an unauthenticated endpoint before it is rendered on an admin page . This vulnera...

CVE-2026-84734

The Mindstien Quick Login WordPress plugin (version 1.0 and below ) is vulnerable to an unauthenticated administrator account takeover . The root cause is a failure to correctly validate a request value against the visitor's session before authentication, specifically involving the 'mql_pass' par...

CVE-2026-84261 click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored XSS via post_notifications

The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-84261 click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored XSS via post_notifications

The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

EUVD-2026-96759

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

EUVD-2026-96758

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-84734 Mindstien Quick Login <= 1.0 - Unauthenticated Administrator Account Takeover via 'mql_pass' Parameter

The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress...

CVE-2026-84737 Freeton WP <= 1.0.0 - Unauthenticated Account Takeover via 'secod' Parameter

The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated attackers to log in as any user whose email address they know, including administrators...

CVE-2026-84260 click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...