CVE-2026-110030

The Hide Price Until Login WordPress plugin (versions before 1.1.2 ) is vulnerable to unauthenticated account creation . The root cause is that the plugin fails to restrict a guest-registration handler and ignores the site's standard user-registration settings. This allows any user to create a Wo...

WordPress Enable SVG, WebP, and ICO Upload plugin < 1.1.6 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Pierre Rudloff in WordPress Plugin Enable SVG, WebP & ICO Upload versions 1.1.6...

WordPress Enable SVG, WebP, and ICO Upload plugin 1.1.3-1.1.5 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Shyu Yang in WordPress Plugin Enable SVG, WebP & ICO Upload versions 1.1.3-1.1.5...

WordPress Wallet System for WooCommerce plugin < 2.8.2 - Subscriber+ KYC Document Overwrite vulnerability

Subscriber+ KYC Document Overwrite vulnerability discovered by Marcial Diaz in WordPress Plugin Wallet System for WooCommerce versions 2.8.2...

EUVD-2026-112621

The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not honour the site's user-registration setting, allowing anyone to create a WordPress account and obtain a logged-in session even when registration is disabled...

CVE-2026-108685

The WP Post Author WordPress plugin (versions before 4.2.0 ) is vulnerable to an unauthenticated modification of the first user account's profile fields. The root cause is a failure to verify account creation timestamps during front-end registration; if a registration form declares specific field...

CVE-2026-110505 Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitization and perform Stored Cross-Site...

CVE-2026-108763

The Wallet System for WooCommerce WordPress plugin, in versions before 2.8.2 , is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The KYC document submission handler fails to perform ownership or capability checks, allowing it to accept a target user ID from a client-supplied reque...

CVE-2026-110505

The Enable SVG, WebP, and ICO Upload WordPress plugin versions prior to 1.1.6 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to prevent animation elements within uploaded SVG files from changing a link's target to a javascript: URI, effectively bypassing the plug...

CVE-2026-110504

The Enable SVG, WebP, and ICO Upload WordPress plugin, affecting versions 1.1.3 through 1.1.5 , contains a Stored Cross-Site Scripting (XSS) vulnerability. The flaw exists because the plugin fails to sanitize uploaded SVG files when their content is not detected as SVG, yet it continues to store ...

CVE-2026-108685 WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields

The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator...

CVE-2026-108763 Wallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR

The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC document submission handler to the current user's own account, taking the target user ID from a client-supplied request field with no ownership or capability check, allowing authenticated users with minimal...

CVE-2026-110030 Hide Price Until Login < 1.1.2 - Unauthenticated Account Creation via Guest Registration

The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not honour the site's user-registration setting, allowing anyone to create a WordPress account and obtain a logged-in session even when registration is disabled...

EUVD-2026-112622

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks...

EUVD-2026-112623

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitization and perform Stored Cross-Site...

EUVD-2026-112618

The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator...

EUVD-2026-112615

The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and extract data from the database...

CVE-2026-89216 vTables < 0.3 - Unauthenticated SQL Injection via orderby Parameter

The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and extract data from the database...

EUVD-2026-112617

The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads...

CVE-2024-3586 LetterPress < 2.4.0 - Admin+ Stored XSS

The LetterPress WordPress plugin before 2.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...