CVE-2026-59534

The CVE-2026-59534 entry concerns the WordPress plugin Post My CF7 Form (versions

CVE-2026-59534 WordPress Post My CF7 Form plugin <= 6.2.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Post My CF7 Form = 6.2.0 versions...

CVE-2026-59533 WordPress Relevanssi Light plugin <= 1.2.2 - SQL Injection vulnerability

Unauthenticated SQL Injection in Relevanssi Light = 1.2.2 versions...

CVE-2026-59533

The CVE concerns the WordPress Relevanssi Light plugin (versions &lt;= 1.2.2). It describes an unauthenticated SQL injection vulnerability in this plugin, with CVSS v3.1 indicating a CRITICAL base score (9.3) and HIGH confidentiality impact. The affected component is the Relevanssi Light plugin f...

CVE-2026-59532 WordPress Booking and Rental Manager plugin <= 2.7.2 - Price Manipulation vulnerability

Unauthenticated Other Vulnerability Type in Booking and Rental Manager = 2.7.2 versions...

CVE-2026-59531

CVE-2026-59531 applies to the WordPress Falcon – WordPress Optimizations & Tweaks plugin, version

CVE-2026-59532 WordPress Booking and Rental Manager plugin <= 2.7.2 - Price Manipulation vulnerability

Unauthenticated Other Vulnerability Type in Booking and Rental Manager = 2.7.2 versions...

CVE-2026-59532

The CVE concerns the WordPress Booking and Rental Manager plugin for WooCommerce (versions

CVE-2026-59531

Unauthenticated Unknown in Falcon – WordPress Optimizations & Tweaks = 2.10.0 versions...

EUVD-2026-49207

Unauthenticated Unknown in Falcon – WordPress Optimizations & Tweaks = 2.10.0 versions...

CVE-2026-59531 WordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.10.0 - Unknown vulnerability

Unauthenticated Unknown in Falcon – WordPress Optimizations & Tweaks = 2.10.0 versions...

CVE-2026-59530

CVE-2026-59530 affects the WordPress Stripe For WooCommerce plugin (versions

CVE-2026-59530 WordPress Stripe For WooCommerce plugin <= 4.0.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Stripe For WooCommerce = 4.0.7 versions...

CVE-2026-59529

The CVE-2026-59529 entry concerns the WordPress Ebook Store plugin versions ≤ 6.19 with an unauthenticated sensitive data exposure vulnerability. Provided details indicate an external attacker can access sensitive data without authentication (CVSS v3.1: 7.5 HIGH, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A...

CVE-2026-59528 WordPress ShipTime: Discounted Shipping Rates plugin <= 1.1.1 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates = 1.1.1 versions...

CVE-2026-59529 WordPress Ebook Store plugin <= 6.19 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Ebook Store = 6.19 versions...

CVE-2026-59527

The CVE-2026-59527 entry describes an unauthenticated SQL Injection in the WordPress MapSVG plugin, affected versions 8.14.0 and earlier. The issue originates from MapSVG’s handling of inputs in vulnerable components, allowing a remote attacker to manipulate queries and potentially access or modi...

CVE-2026-59527 WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability

Unauthenticated SQL Injection in MapSVG = 8.14.0 versions...

WordPress FormCraft plugin <= 3.9.15 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by luc in WordPress Plugin FormCraft versions = 3.9.15...

Arbitrary code execution

Impact WordPress Coding Standards WordPressCS versions before 3.4.1 contain an arbitrary code execution vulnerability in the WordPress.WP.EnqueuedResourceParameters sniff. As a result, running PHPCS with WordPressCS over untrusted PHP code, for example, in a CI pipeline that lints pull requests, ...