EUVD-2026-112625

The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security AIOS WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker who knows a victim's password and holds their own...

CVE-2026-111739

The Two Factor Authentication WordPress plugin (versions < 1.17.0) and the All-In-One Security (AIOS) WordPress plugin (versions

EUVD-2026-112627

The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to read arbitrary files including ones containing the database credentials and...

CVE-2026-114270 GeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure

The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password...

CVE-2026-113617 Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal

The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to read arbitrary files including ones containing the database credentials and...

WordPress WP Photo Album Plus plugin < 9.3.04.004 - Photo Comment Deletion vulnerability

Photo Comment Deletion vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin WP Photo Album Plus versions 9.3.04.004...

CVE-2026-110030

The Hide Price Until Login WordPress plugin (versions before 1.1.2 ) is vulnerable to unauthenticated account creation . The root cause is that the plugin fails to restrict a guest-registration handler and ignores the site's standard user-registration settings. This allows any user to create a Wo...

EUVD-2026-112621

The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not honour the site's user-registration setting, allowing anyone to create a WordPress account and obtain a logged-in session even when registration is disabled...

CVE-2026-108685

The WP Post Author WordPress plugin (versions before 4.2.0 ) is vulnerable to an unauthenticated modification of the first user account's profile fields. The root cause is a failure to verify account creation timestamps during front-end registration; if a registration form declares specific field...

CVE-2026-110505 Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitization and perform Stored Cross-Site...

CVE-2026-108763

The Wallet System for WooCommerce WordPress plugin, in versions before 2.8.2 , is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The KYC document submission handler fails to perform ownership or capability checks, allowing it to accept a target user ID from a client-supplied reque...

CVE-2026-110505

The Enable SVG, WebP, and ICO Upload WordPress plugin versions prior to 1.1.6 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to prevent animation elements within uploaded SVG files from changing a link's target to a javascript: URI, effectively bypassing the plug...

CVE-2026-110504

The Enable SVG, WebP, and ICO Upload WordPress plugin, affecting versions 1.1.3 through 1.1.5 , contains a Stored Cross-Site Scripting (XSS) vulnerability. The flaw exists because the plugin fails to sanitize uploaded SVG files when their content is not detected as SVG, yet it continues to store ...

CVE-2026-108685 WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields

The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator...

CVE-2026-108763 Wallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR

The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC document submission handler to the current user's own account, taking the target user ID from a client-supplied request field with no ownership or capability check, allowing authenticated users with minimal...

CVE-2026-110030 Hide Price Until Login < 1.1.2 - Unauthenticated Account Creation via Guest Registration

The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not honour the site's user-registration setting, allowing anyone to create a WordPress account and obtain a logged-in session even when registration is disabled...

EUVD-2026-112622

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks...

EUVD-2026-112623

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitization and perform Stored Cross-Site...

EUVD-2026-112618

The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator...

WordPress Enable SVG, WebP, and ICO Upload plugin < 1.1.6 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Pierre Rudloff in WordPress Plugin Enable SVG, WebP & ICO Upload versions 1.1.6...