CVE-2026-10630

WP Courses LMS (WordPress plugin) is vulnerable to Insecure Direct Object Reference (IDOR) in all versions up to and including 3.2.29 . The resultID parameter in the wpcq_get_quiz_result AJAX action lacks proper ownership validation, allowing authenticated users with custom-level access or above ...

EUVD-2026-65192

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.29 via the 'resultID' parameter due to missing validation on a user controlled key...

EUVD-2026-65169

Unauthenticated PHP Object Injection in WP Project Manager = 4.0.6 versions...

CVE-2026-78262

WP Project Manager (WordPress plugin by WeDevs ) is affected by an unauthenticated PHP Object Injection vulnerability in versions ≤ 4.0.6 . The flaw allows a remote, unauthenticated attacker over the network with low complexity and no user interaction to achieve high impact on confidentiality, in...

CVE-2026-66587

Unauthenticated Local File Inclusion in WP Cafe Pro 3.0.15 versions...

CVE-2026-66585

Unauthenticated Sensitive Data Exposure in WP Cafe Pro 3.0.15 versions...

CVE-2026-32478

Subscriber SQL Injection in WP Project Manager Pro = 4.0.1 versions...

CVE-2026-66585

CVE-2026-66585 is an unauthenticated sensitive data exposure in the WP Cafe Pro WordPress plugin, affecting versions below 3.0.15 . The vulnerability allows remote attackers with no privileges to access sensitive data, yielding a CVSS 3.1 base score of 7.5 (HIGH) with high confidentiality impact ...

CVE-2026-66587

WP Cafe Pro is a WordPress plugin affected by an unauthenticated Local File Inclusion (LFI) vulnerability in versions prior to 3.0.15 . Discovered by Ananda Dhakal via Patchstack, the flaw requires no authentication or user interaction and is scored CVSS 9.8 (Critical) with full confidentiality, ...

CVE-2026-66585 WordPress WP Cafe Pro plugin < 3.0.15 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in WP Cafe Pro 3.0.15 versions...

CVE-2026-66587 WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in WP Cafe Pro 3.0.15 versions...

EUVD-2026-64806

Unauthenticated Local File Inclusion in WP Cafe Pro 3.0.15 versions...

EUVD-2026-64805

Unauthenticated Sensitive Data Exposure in WP Cafe Pro 3.0.15 versions...

CVE-2026-32478 WordPress WP Project Manager Pro plugin <= 4.0.1 - SQL Injection vulnerability

Subscriber SQL Injection in WP Project Manager Pro = 4.0.1 versions...

EUVD-2026-64802

Subscriber SQL Injection in WP Project Manager Pro = 4.0.1 versions...

WordPress Yuzo <5.12.94 - Cross-Site Scripting

WordPress Yuzo Related Posts plugin before 5.12.94 is vulnerable to cross-site scripting because it mistakenly expects that isadmin verifies that the request comes from an admin user it actually only verifies that the request is for an admin page. An unauthenticated attacker can consequently inje...

WP Hotel Booking <= 2.3.2 - Cross-Site Scripting

The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'checkindate' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

Ditty < 3.1.25 - Cross-Site Scripting

The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin. id: CVE-2023-4148 info: name: Ditty 3.1.25 ...

Ninja Forms < 3.6.22 - Cross-Site Scripting

Ninja Forms before 3.6.22 is susceptible to cross-site scripting via the page parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to...

Video List Manager <= 1.7 - SQL Injection

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin. id: CVE-2023-1408 info: name: Video List Manager = 1.7 - SQL Injection author: r3Y3r53 severity: high description: | The...