CVE-2026-73392 WordPress Super Store Finder plugin <= 7.8 - SQL Injection vulnerability

Unauthenticated SQL Injection in Super Store Finder = 7.8 versions...

CVE-2026-73392

The WordPress Super Store Finder plugin (versions ≤7.8) has an unauthenticated SQL injection flaw, allowing remote attackers to execute arbitrary SQL queries without credentials. Patchstack rates it CRITICAL (CVSS 9.3). No patch or exploit details are provided in the documents.

EUVD-2026-60798

Shop manager Arbitrary File Download in CTX Feed = 6.6.47 versions...

CVE-2026-73383 WordPress CTX Feed plugin <= 6.6.47 - Arbitrary File Download vulnerability

Shop manager Arbitrary File Download in CTX Feed = 6.6.47 versions...

CVE-2026-73383

The WordPress CTX Feed plugin (versions ≤ 6.6.47) allows a Shop Manager to download arbitrary files from the server. CVSS 3.1 scores it MEDIUM (4.9), requiring network access and HIGH privileges. Patchstack discovered the flaw; update to a patched version beyond 6.6.47 to remediate. No exploitati...

CVE-2026-73382 WordPress Site Reviews plugin <= 8.2.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Site Reviews = 8.2.0 versions...

CVE-2026-73382

Unauthenticated Cross Site Scripting XSS in Site Reviews = 8.2.0 versions...

CVE-2026-73382

The WordPress Site Reviews plugin (versions ≤ 8.2.0) has an unauthenticated Cross-Site Scripting (XSS) vulnerability, exploitable over the network with no privileges required, rated CVSS 7.1 HIGH. No in-the-wild exploitation has been reported. No patch version is provided in the available documen...

EUVD-2026-60796

Unauthenticated Broken Authentication in Popup by Supsystic = 1.13.0 versions...

CVE-2026-73381 WordPress Popup by Supsystic plugin <= 1.13.0 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Popup by Supsystic = 1.13.0 versions...

CVE-2026-73380

CVE-2026-73380 is an unauthenticated PHP Object Injection vulnerability in the WordPress plugin Popup by Supsystic , affecting versions ≤ 1.13.0 . The vulnerability was discovered by Asim Alshaya and rated CVSS 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating full c...

CVE-2026-73381

Unauthenticated Broken Authentication in Popup by Supsystic = 1.13.0 versions...

CVE-2026-73380 WordPress Popup by Supsystic plugin <= 1.13.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...

CVE-2026-73380

Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...

CVE-2026-73381

The WordPress Popup by Supsystic plugin (versions ≤ 1.13.0) has an unauthenticated broken authentication flaw rated CVSS 9.1 (Critical), allowing remote attackers to bypass authentication with no privileges, risking integrity and availability. No exploitation or patch details are provided in the ...

CVE-2026-73379 WordPress Contact Form by Supsystic plugin < 1.10.0 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Contact Form by Supsystic 1.10.0 versions...

CVE-2026-73379

Affected component: Contact Form by Supsystic plugin for WordPress, versions before 1.10.0. Vulnerability type: Unauthenticated bypass, allowing network-accessible attackers to circumvent access controls without credentials. CVSS 3.1: 6.5 MEDIUM (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Exploitation...

CVE-2026-73378 WordPress Contact Form by Supsystic plugin < 1.10.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Contact Form by Supsystic 1.10.0 versions...

CVE-2026-73378

An unauthenticated Cross-Site Scripting (XSS) vulnerability exists in the WordPress "Contact Form by Supsystic" plugin versions below 1.10.0, allowing remote attackers to inject malicious scripts that execute in users' browsers. CVSS 3.1 scores it HIGH (7.1). Upgrade to version 1.10.0 or later. N...

CVE-2026-73377

The Ultimate Maps by Supsystic WordPress plugin (versions below 1.5.0) has an unauthenticated broken access control flaw allowing remote attackers to perform unauthorized actions with high integrity impact; no exploitation is reported in the provided documents.