WordPress WP Social Avatar plugin <= 1.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by muqsithbarru in WordPress Plugin WP Social Avatar versions = 1.5...

WordPress Salon booking system plugin <= 10.30.26 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Evan NR in WordPress Plugin Salon booking system versions = 10.30.26...

WordPress Geo Mashup plugin <= 1.13.18 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by daroo in WordPress Plugin Geo Mashup versions = 1.13.18...

WordPress Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Geo Mashup versions = 1.13.18...

CVE-2026-15239 Simple CAPTCHA with Cloudflare Turnstile < 1.42.0 - Unauthenticated Turnstile Protection Bypass via Reusable Forminator Cache Key

The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value, allowing unauthenticated attackers to solv...

CVE-2026-15239

CVE-2026-15239 affects the Simple CAPTCHA with Cloudflare Turnstile WordPress plugin (pre-1.42.0). The vulnerability arises because the Turnstile validation cache isn’t bound to the single-use challenge token, instead tying to an attacker-controlled reusable request value, enabling unauthenticate...

EUVD-2026-54401

The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value, allowing unauthenticated attackers to solv...

CVE-2026-15148 WP Events Manager < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via IDOR

The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate...

CVE-2026-15148

Technical details are not publicly available in the provided documents. Monitor for updates.

EUVD-2026-54399

The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate...

WordPress If-So Dynamic Content Personalization plugin <= 1.10 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dutafi in WordPress Plugin If-So Dynamic Content Personalization versions = 1.10...

WordPress REST API Log plugin <= 1.7.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Aydan Arabadzha in WordPress Plugin REST API Log versions = 1.7.1...

WordPress MultiVendorX plugin <= 5.0.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Uma Mo in WordPress Plugin MultiVendorX versions = 5.0.10...

WordPress Active Products Tables for WooCommerce plugin <= 1.1.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Asim Alshaya in WordPress Plugin Active Products Tables for WooCommerce versions = 1.1.1...

WordPress WPJAM Basic plugin <= 7.0.2.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by winky in WordPress Plugin WPJAM Basic versions = 7.0.2.1...

WordPress Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) plugin <= 1.0.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Bitcoin Lightning Payment Gateway for WooCommerce via CLINK versions = 1.0.7...

WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Visitor Traffic Real Time Statistics Pro versions = 11.10...

WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Visitor Traffic Real Time Statistics Pro versions = 11.10...

CVE-2026-16039

The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information...

CVE-2026-16041

The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores...