CVE-2026-96567: Improper Neutralization of Input During Web Page Generation

The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postid' parameter in all versions up to, and including, 5.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

CVE-2026-97281

Subscriber Broken Access Control in WP Project Manager = 4.0.7 versions...

CVE-2026-62073

Unauthenticated Broken Access Control in WP Full Stripe Free = 8.5.6 versions...

CVE-2026-103347

Unauthenticated Bypass Vulnerability in hCaptcha for WP = 5.3.0 versions...

CVE-2026-103347

The hCaptcha for WP plugin for WordPress (versions

CVE-2026-103347 WordPress hCaptcha for WP plugin <= 5.3.0 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in hCaptcha for WP = 5.3.0 versions...

CVE-2026-103347 WordPress hCaptcha for WP plugin <= 5.3.0 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in hCaptcha for WP = 5.3.0 versions...

EUVD-2026-90846

Unauthenticated Bypass Vulnerability in hCaptcha for WP = 5.3.0 versions...

CVE-2026-97281 WordPress WP Project Manager plugin <= 4.0.7 - Broken Access Control vulnerability

Subscriber Broken Access Control in WP Project Manager = 4.0.7 versions...

CVE-2026-97281 WordPress WP Project Manager plugin <= 4.0.7 - Broken Access Control vulnerability

Subscriber Broken Access Control in WP Project Manager = 4.0.7 versions...

CVE-2026-97281

The WP Project Manager plugin for WordPress (versions

EUVD-2026-90839

Subscriber Broken Access Control in WP Project Manager = 4.0.7 versions...

CVE-2026-62073

The WP Full Stripe Free WordPress plugin (versions

CVE-2026-62073 WordPress WP Full Stripe Free plugin <= 8.5.6 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Full Stripe Free = 8.5.6 versions...

CVE-2026-62073 WordPress WP Full Stripe Free plugin <= 8.5.6 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Full Stripe Free = 8.5.6 versions...

EUVD-2026-90853

Unauthenticated Broken Access Control in WP Full Stripe Free = 8.5.6 versions...

WordPress hCaptcha for WP plugin <= 5.3.0 - Bypass Vulnerability vulnerability

Bypass Vulnerability vulnerability discovered by bamper1 in WordPress Plugin hCaptcha for WP versions = 5.3.0...

WordPress WP Project Manager plugin <= 4.0.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nixxies in WordPress Plugin WP Project Manager versions = 4.0.7...

CVE-2026-103067

Cross-Site Request Forgery CSRF vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Cross Site Request Forgery.This issue affects Memberful - Membership Plugin: from n/a through 1.81.0...

CVE-2026-103343

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP ManageNinja LLC FluentForm fluentform allows Stored XSS.This issue affects FluentForm: from n/a through 6.2.14...