CVE-2026-80067

MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stmlmsstep parameter passed to the stmlmsimportsampledata AJAX action,...

CVE-2026-54852

Missing Authorization vulnerability in miniOrange Page Restriction WordPress WP page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress WP: from n/a through 1.6.1...

WordPress Kirki plugin <= 6.4.0 - Content Injection vulnerability

Content Injection vulnerability discovered by nh4tvd in WordPress Plugin Kirki versions = 6.4.0...

WordPress Document Library Lite plugin <= 1.3.0 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Nixxies in WordPress Plugin Document Library Lite versions = 1.3.0...

WordPress WP ERP plugin <= 1.17.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin WP ERP versions = 1.17.10...

CVE-2026-54852

The miniOrange Page Restriction WordPress (WP) plugin, specifically versions up to and including 1.6.1 , is vulnerable to a Missing Authorization (Broken Access Control) flaw. The vulnerability arises from incorrectly configured access control security levels , which could allow unauthorized acti...

CVE-2026-54852 WordPress Page Restriction WordPress (WP) plugin <= 1.6.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in miniOrange Page Restriction WordPress WP page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress WP: from n/a through 1.6.1...

CVE-2026-54852 WordPress Page Restriction WordPress (WP) plugin <= 1.6.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in miniOrange Page Restriction WordPress WP page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress WP: from n/a through 1.6.1...

EUVD-2026-112887

Missing Authorization vulnerability in miniOrange Page Restriction WordPress WP page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress WP: from n/a through 1.6.1...

WordPress EventPrime plugin <= 4.3.6.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin EventPrime versions = 4.3.6.0...

WordPress Page Restriction WordPress (WP) plugin <= 1.6.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by mj404error in WordPress Plugin Page Restriction WordPress WP versions = 1.6.1...

WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by foehn in WordPress Plugin myCred versions = 4.0.2...

WordPress WPFunnels plugin <= 3.13.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by mamgad in WordPress Plugin WPFunnels versions = 3.13.5...

WordPress Flash & HTML5 Video plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Flash & HTML5 Video versions = 2.14.0...

CVE-2026-27063 WordPress Kit (formerly ConvertKit) plugin <= 3.4.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in Kit Kit formerly ConvertKit convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit formerly ConvertKit: from n/a through 3.4.7...

CVE-2026-27063 WordPress Kit (formerly ConvertKit) plugin <= 3.4.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in Kit Kit formerly ConvertKit convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit formerly ConvertKit: from n/a through 3.4.7...

CVE-2026-27063

The WordPress Kit (formerly ConvertKit) plugin (versions

WordPress Custom Price for WooCommerce plugin <= 1.1.29 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by ssophiz in WordPress Plugin Custom Price for WooCommerce versions = 1.1.29...

WordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Sangho Lee in WordPress Plugin Profile Builder versions = 4.0.5...

WordPress Kit (formerly ConvertKit) plugin <= 3.4.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Taegyeong Yun in WordPress Plugin Kit formerly ConvertKit versions = 3.4.7...