EUVD-2026-63907

The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts...

CVE-2026-13176 Eventin < 4.1.21 - Contributor+ Server-Side Request Forgery

The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts...

CVE-2026-13176

The Eventin WordPress plugin before 4.1.21 contains a blind Server-Side Request Forgery (SSRF) vulnerability. The plugin fails to validate user-supplied webhook URLs stored on events and does not verify event ownership, allowing authenticated users with contributor-level access or above to trigge...

WordPress Automation Web Platform plugin <= 4.8.6 - Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosure vulnerability

Unauthenticated Authentication Bypass via 'otptransient' Token Disclosure vulnerability discovered by RIA Labs - RIA Labs in WordPress Plugin Wawp versions = 4.8.6...

WordPress WPForms Pro plugin <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values vulnerability

Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values vulnerability discovered by daroo in WordPress Plugin WPForms Pro versions = 2.0.0.2...

WordPress AI Agent by SiteGround plugin <= 1.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Upload via /generate-content REST Endpoint vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Media Upload via /generate-content REST Endpoint vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin SG AI Studio versions = 1.2.7...

WordPress W3 Total Cache plugin < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key vulnerability

Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key vulnerability discovered by Jakub Herman in WordPress Plugin W3 Total Cache versions 2.10.5...

WordPress TabaPay Gateway plugin <= 1.4.0 - Unauthenticated Account Takeover via Payment Callback vulnerability

Unauthenticated Account Takeover via Payment Callback vulnerability discovered by moonge in WordPress Plugin TabaPay Gateway versions = 1.4.0...

WordPress Product Shortlist plugin <= 1.0.4 - Unauthenticated SQL Injection via get_shortlisted_products vulnerability

Unauthenticated SQL Injection via getshortlistedproducts vulnerability discovered by João Ramos Maciel in WordPress Plugin Product Shortlist versions = 1.0.4...

WordPress Simple File List plugin <= 6.3.11 - Unauthenticated Stored XSS via File Description vulnerability

Unauthenticated Stored XSS via File Description vulnerability discovered by Ruwantha Harshamal in WordPress Plugin Simple File List versions = 6.3.11...

WordPress Simple File List plugin <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal vulnerability

Unauthenticated Arbitrary File Read and Move via Path Traversal vulnerability discovered by Sanjar Tulkinov in WordPress Plugin Simple File List versions = 6.3.11...

WordPress User Verification plugin <= 2.0.47 - Unauthenticated Arbitrary Account Lockout via IDOR vulnerability

Unauthenticated Arbitrary Account Lockout via IDOR vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin User Verification versions = 2.0.47...

WordPress YayCurrency plugin < 3.3.5 - Unauthenticated Order and Vendor Financial Data Disclosure via Dokan Integration vulnerability

Unauthenticated Order and Vendor Financial Data Disclosure via Dokan Integration vulnerability discovered by Shivamani Vastrala in WordPress Plugin YayCurrency versions 3.3.5...

WordPress Easy Media Replace plugin <= 0.2.0 - Author+ Stored XSS via Attachment Title vulnerability

Author+ Stored XSS via Attachment Title vulnerability discovered by testoun in WordPress Plugin Easy Media Replace versions = 0.2.0...

WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Unauthenticated Stored XSS via SVG File Upload vulnerability

Unauthenticated Stored XSS via SVG File Upload vulnerability discovered by Samdup Choephel in WordPress Plugin Booking calendar, Appointment Booking System versions = 3.2.36...

WordPress Gift Cards For WooCommerce Pro plugin < 4.2.10 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Brandon Steed in WordPress Plugin Gift Cards For WooCommerce Pro versions 4.2.10...

CVE-2026-19435

The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content...

CVE-2026-18781

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server...

CVE-2026-19085

The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable...

CVE-2026-14601

The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks...