CVE-2026-73356 WordPress Breeze plugin <= 2.5.12 - Arbitrary Content Deletion vulnerability

Unauthenticated Arbitrary Content Deletion in Breeze = 2.5.12 versions...

CVE-2026-73356

Unauthenticated Arbitrary Content Deletion in Breeze = 2.5.12 versions...

CVE-2026-73356

The Breeze WordPress plugin (versions

EUVD-2026-60780

Unauthenticated SQL Injection in Affiliates Manager = 2.9.53 versions...

CVE-2026-73355 WordPress Affiliates Manager plugin <= 2.9.53 - SQL Injection vulnerability

Unauthenticated SQL Injection in Affiliates Manager = 2.9.53 versions...

CVE-2026-73355

Unauthenticated SQL injection affects Affiliates Manager plugin ≤2.9.53, allowing remote attackers to extract sensitive database data (CVSS 9.3 critical). Patchstack reports the flaw; no patch version or exploit details are provided in the documents. Upgrade to the latest plugin version once avai...

CVE-2026-73355

Unauthenticated SQL Injection in Affiliates Manager = 2.9.53 versions...

CVE-2026-73352

The WordPress GiveWP donation plugin (versions ≤ 4.16.5.1) has an unauthenticated broken access control flaw (CVSS 6.5) discovered by Dthangws, allowing unauthorized read/write of data. Upgrade to a newer GiveWP version. PatchStack advisory: https://patchstack.com/database/wordpress/plugin/give/v...

CVE-2026-73352 WordPress GiveWP plugin <= 4.16.5.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in GiveWP = 4.16.5.1 versions...

CVE-2026-73351 WordPress WordPress Social Login and Register plugin <= 7.8.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.1 versions...

EUVD-2026-60778

Unauthenticated Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.1 versions...

CVE-2026-73351

Unauthenticated Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.1 versions...

CVE-2026-73351

Unauthenticated XSS affects the WordPress Social Login and Register plugin at version 7.8.1 or earlier (CVSS 7.1, HIGH). No specific affected component or remediation version is provided; update to a newer plugin release when available.

CVE-2026-73348

GiveWP WordPress plugin versions before 4.16.6 have an unauthenticated broken access control flaw, allowing network-based attackers with no credentials to access restricted functionality (CVSS 6.5). Upgrade to 4.16.6 or later. No in-the-wild exploitation reported. Details: https://patchstack.com/...

CVE-2026-73350

Unauthenticated Broken Authentication in SupportCandy = 3.5.1 versions...

CVE-2026-73350

SupportCandy is a WordPress plugin affected by an unauthenticated Broken Authentication vulnerability in versions ≤ 3.5.1 . The flaw allows a remote, unauthenticated attacker to bypass authentication over the network with low complexity and no user interaction, resulting in high confidentiality i...

CVE-2026-73350 WordPress SupportCandy plugin <= 3.5.1 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in SupportCandy = 3.5.1 versions...

CVE-2026-73343

Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...

EUVD-2026-60774

Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...

CVE-2026-73343 WordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerability

Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...