EUVD-2026-63312

Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...

CVE-2026-73993 WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...

CVE-2026-73992 WordPress Query Wrangler plugin <= 1.5.57 - Remote Code Execution (RCE) vulnerability

Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...

EUVD-2026-63311

Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...

CVE-2026-73992

The WordPress Query Wrangler plugin (versions ≤ 1.5.57) allows authenticated subscribers to execute arbitrary code remotely, yielding full server compromise (CVSS 9.9 Critical, network-exploitable with low complexity). No in-the-wild exploitation or patch version is documented in the provided sou...

EUVD-2026-63309

Unauthenticated SQL Injection in BookingPress Appointment Booking Pro = 6.0.2 versions...

CVE-2026-68566

The WordPress BookingPress Appointment Booking Pro plugin (versions ≤ 6.0.2) contains an unauthenticated SQL injection vulnerability exploitable over the network with no credentials required, scoring 9.3 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L). High confidentiality impact is possi...

CVE-2026-68566 WordPress BookingPress Appointment Booking Pro plugin <= 6.0.2 - SQL Injection vulnerability

Unauthenticated SQL Injection in BookingPress Appointment Booking Pro = 6.0.2 versions...

EUVD-2026-63308

Unauthenticated Cross Site Scripting XSS in NotificationX Pro = 3.1.4 versions...

CVE-2026-68564 WordPress NotificationX Pro plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in NotificationX Pro = 3.1.4 versions...

CVE-2026-66680 WordPress Locatoraid Store Locator plugin <= 3.9.72 - SQL Injection vulnerability

Unauthenticated SQL Injection in Locatoraid Store Locator = 3.9.72 versions...

CVE-2026-66682 WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4.0 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce = 10.4.0 versions...

CVE-2026-66680

Locatoraid Store Locator is a WordPress plugin affected by an unauthenticated SQL injection vulnerability in versions

CVE-2026-66677 WordPress Leyka plugin <= 3.32.3 - Broken Authentication vulnerability

Subscriber Broken Authentication in Leyka = 3.32.3 versions...

CVE-2026-66677

CVE-2026-66677 is a Broken Authentication vulnerability in the WordPress plugin Leyka affecting versions

CVE-2026-66673 WordPress Flatastic theme <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Flatastic = 2.0 versions...

CVE-2026-66649 WordPress Directory Pro plugin <= 2.5.8 - SQL Injection vulnerability

Unauthenticated SQL Injection in Directory Pro = 2.5.8 versions...

CVE-2026-66672 WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Flatastic = 2.0 versions...

CVE-2026-66649

The WordPress Directory Pro plugin (versions ≤ 2.5.8) has an unauthenticated SQL injection vulnerability exploitable over the network with low complexity, scoring 9.3 critical. Patchstack advises upgrading to a patched version; no in-the-wild exploitation details are provided in the documents.

CVE-2026-66672

The WordPress Flatastic theme (versions ≤ 2.0) is vulnerable to unauthenticated PHP Object Injection, exploitable over the network without credentials. The Patchstack advisory documents the issue; no exploit code or in-the-wild activity is reported. Affected sites should update to a patched theme...