CVE-2026-28187

Unauthenticated Cross Site Scripting XSS in Knowledge Base for Documentation, FAQs with AI Assistance = 17.211.0 versions...

CVE-2026-28186

Subscriber Broken Access Control in Travelfic Toolkit = 1.5.1 versions...

CVE-2026-28170

Unauthenticated Cross Site Scripting XSS in Blog Floating Button = 1.4.20 versions...

CVE-2026-28174

Customer Sensitive Data Exposure in WP Event SOlution = 4.1.18 versions...

CVE-2026-28175

Unauthenticated Cross Site Scripting XSS in Visitors Traffic Real Time Statistics = 8.11 versions...

CVE-2026-28149

Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...

CVE-2026-28159

Subscriber Broken Access Control in Service Finder Booking = 6.2 versions...

CVE-2026-28161

Subscriber Privilege Escalation in Service Finder Booking = 6.2 versions...

CVE-2026-28002

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22...

CVE-2026-27999

Subscriber Broken Access Control in Tourfic = 2.23.1 versions...

CVE-2026-28003

Unauthenticated Cross Site Scripting XSS in Maspik – Spam blacklist = 2.9.1 versions...

CVE-2026-28004

Unauthenticated Cross Site Scripting XSS in Business Directory = 6.4.25 versions...

CVE-2026-27543

Unauthenticated Privilege Escalation in MStore API = 4.20.0 versions...

CVE-2026-27538

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

CVE-2026-27380

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

CVE-2026-28002

CVE-2026-28002 affects the WordPress Booktics plugin up to version 1.0.22. The issue is an SQL Injection (blind) caused by improper neutralization of special elements in SQL commands, enabling potential unauthorized data access. No exploitation details or patches are provided in the documents; re...

CVE-2026-28002 WordPress Booktics plugin 1.0.22 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22...

CVE-2026-73401

CVE-2026-73401 affects the WordPress InstaWP Connect plugin (versions

CVE-2026-73401 WordPress InstaWP Connect plugin <= 0.1.3.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in InstaWP Connect = 0.1.3.7 versions...

CVE-2026-73403

The CVE-2026-73403 entry concerns the WordPress User Registration plugin (versions ≤ 5.2.6) with unauthenticated broken access control in its registration flow. Affected software: WordPress User Registration plugin; vulnerable component: registration/authentication logic described as enforcing br...