CVE-2026-68568 WordPress MasterStudy LMS plugin <= 3.7.41 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in MasterStudy LMS = 3.7.41 versions...

CVE-2026-68567

The WordPress Convert Pro plugin (versions ≤ 1.0.1) contains an unauthenticated reflected/stored XSS flaw exploitable via network access with low complexity; CVSS 7.1 (High). Patchstack reports it. Upgrade to a patched version if available; no exploitation evidence provided. See https://patchstac...

CVE-2026-68567 WordPress Convert Pro plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Convert Pro = 1.0.1 versions...

CVE-2026-68565 WordPress GeoDirectory plugin <= 2.8.172 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in GeoDirectory = 2.8.172 versions...

EUVD-2026-60934

Contributor Cross Site Scripting XSS in GeoDirectory = 2.8.172 versions...

CVE-2026-68565

Contributor-level XSS in the WordPress GeoDirectory plugin affects versions up to 2.8.172 (CVE description) or 2.8.174 (Patchstack report), exploitable by authenticated users with contributor privileges to inject scripts affecting other users. No patch version or in-the-wild exploitation details ...

CVE-2026-68565

Contributor Cross Site Scripting XSS in GeoDirectory = 2.8.172 versions...

CVE-2026-66679 WordPress Appointment Hour Booking plugin <= 1.5.91 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Appointment Hour Booking = 1.5.91 versions...

EUVD-2026-60933

Unauthenticated Broken Access Control in Appointment Hour Booking = 1.5.91 versions...

CVE-2026-66679

WordPress plugin Appointment Hour Booking (≤1.5.91) has an unauthenticated broken access control flaw, allowing network-based attackers to alter data or cause partial disruption. No in-the-wild exploitation is reported; updating to version 1.5.92+ is recommended.

CVE-2026-66667 WordPress Templately plugin <= 3.7.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Templately = 3.7.1 versions...

EUVD-2026-60932

Unauthenticated Cross Site Scripting XSS in Templately = 3.7.1 versions...

CVE-2026-66667

The WordPress Templately plugin (versions ≤ 3.7.1) contains an unauthenticated reflected/stored XSS vulnerability discovered by researcher daroo, rated CVSS 7.1 (HIGH). Attackers can inject malicious scripts via network requests requiring no authentication, potentially compromising user sessions ...

CVE-2026-66651

MultiVendorX WordPress plugin (versions ≤ 5.0.14) has an unauthenticated broken access control flaw. CVSS 6.5 (Medium) — network-reachable, no auth needed, low confidentiality and integrity impact. No patch version or exploit details provided; update once a fixed release is available. Monitor Pat...

CVE-2026-66651 WordPress MultiVendorX plugin <= 5.0.14 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in MultiVendorX = 5.0.14 versions...

CVE-2026-66651

Unauthenticated Broken Access Control in MultiVendorX = 5.0.14 versions...

EUVD-2026-60930

Contributor Cross Site Scripting XSS in WP Tab Widget = 1.2.11 versions...

CVE-2026-66646

Contributor Cross Site Scripting XSS in WP Tab Widget = 1.2.11 versions...

CVE-2026-66646 WordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in WP Tab Widget = 1.2.11 versions...

CVE-2026-66646

The WordPress plugin WP Tab Widget (versions ≤ 1.2.11) contains a contributor-level stored XSS vulnerability: untrusted input is output without sanitization, allowing a contributor to inject scripts that execute in visitors' browsers. CVSS 3.1 scores 6.5 (Medium). CISA SSVC reports no known explo...