CVE-2026-73996 WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Masteriyo - LMS = 2.3.2 versions...

CVE-2026-73996

The Masteriyo LMS WordPress plugin (≤2.3.2) allows unauthenticated arbitrary file uploads, enabling remote code execution on affected sites. Patchstack rates it Critical (CVSS 9.8). No patch version or exploitation evidence is provided in the documents.

CVE-2026-73995 WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability

Subscriber Broken Authentication in User Registration = 5.2.6 versions...

CVE-2026-73995

The WordPress User Registration plugin (versions ≤ 5.2.6) has a broken authentication flaw allowing subscribers to bypass access controls; CVSS 5.4 (MEDIUM). CISA SSVC reports no active exploitation. No exploit code is provided; upgrade beyond 5.2.6 to remediate. Details via Patchstack reference.

EUVD-2026-60808

Unauthenticated Broken Access Control in Charitable = 1.8.11.3 versions...

CVE-2026-73994 WordPress Charitable plugin <= 1.8.11.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Charitable = 1.8.11.3 versions...

CVE-2026-73994

CVE-2026-73994 is an unauthenticated Broken Access Control vulnerability in the WordPress Charitable plugin , affecting versions 1.8.11.3 and earlier . The flaw allows a remote attacker with no privileges to modify data, resulting in a high integrity impact (CVSS 3.1 score: 7.5 HIGH ). CISA's SSV...

CVE-2026-73404 WordPress MasterStudy LMS plugin <= 3.7.41 - Broken Access Control vulnerability

Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...

CVE-2026-73404

Subscriber users of MasterStudy LMS plugin

CVE-2026-73400 WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress = 2.4.11 versions...

EUVD-2026-60806

Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress = 2.4.11 versions...

CVE-2026-73400

CVE-2026-73400 is an unauthenticated Local File Inclusion (LFI) vulnerability in the WordPress plugin Restaurant Menu by MotoPress , affecting versions 2.4.11 and below . The flaw allows a remote, unauthenticated attacker to include and read local files on the server, potentially leading to full ...

CVE-2026-73400

Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress = 2.4.11 versions...

CVE-2026-73399

The rave-woocommerce-payment-gateway plugin (versions ≤ 3.3.0) has an unauthenticated broken authentication flaw allowing remote attackers to bypass login, rated CVSS 6.5 (Medium). No exploitation evidence is provided; update to a newer plugin version when available. Reference: https://patchstack...

CVE-2026-73398

The WordPress Piraeus Bank WooCommerce Payment Gateway plugin 3.2.0 has a broken authentication flaw exploitable by unauthenticated remote attackers, allowing unauthorized actions with low integrity and availability impact. CVSS 6.5 (Medium). Patchstack advisory linked; no exploit code or specifi...

CVE-2026-73399 WordPress Flutterwave WooCommerce plugin <= 3.3.0 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Flutterwave WooCommerce = 3.3.0 versions...

CVE-2026-73397 WordPress Youzify plugin <= 1.3.7 - Deserialization of untrusted data vulnerability

Unauthenticated Deserialization of untrusted data in Youzify = 1.3.7 versions...

CVE-2026-73396 WordPress MWB HubSpot for WooCommerce plugin <= 1.6.7 - Broken Authentication vulnerability

Subscriber Broken Authentication in MWB HubSpot for WooCommerce = 1.6.7 versions...

CVE-2026-73397

Unauthenticated Deserialization of untrusted data in Youzify = 1.3.7 versions...

CVE-2026-73397

Youzify plugin versions up to 1.3.7 suffer from unauthenticated deserialization of untrusted data, scored CVSS 9.8 (critical) with network access, no privileges, and full CIA impact. Upgrade beyond 1.3.7 or disable the plugin; no exploit code is provided in the documents.