EUVD-2026-85472

Contributor SQL Injection in WP EasyCart = 5.9.4 versions...

CVE-2026-94124 WordPress WP EasyCart plugin <= 5.9.4 - SQL Injection vulnerability

Contributor SQL Injection in WP EasyCart = 5.9.4 versions...

CVE-2026-94079

The WP User Manager plugin for WordPress, affecting versions

CVE-2026-94079 WordPress WP User Manager plugin <= 2.9.19 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP User Manager = 2.9.19 versions...

EUVD-2026-85469

Unauthenticated Broken Access Control in WP User Manager = 2.9.19 versions...

CVE-2026-94079 WordPress WP User Manager plugin <= 2.9.19 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP User Manager = 2.9.19 versions...

EUVD-2026-85468

Unauthenticated Cross Site Scripting XSS in WP Photo Album Plus = 9.3.02.002 versions...

CVE-2026-93774

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in the WP Photo Album Plus WordPress plugin, affecting versions

CVE-2026-93774 WordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WP Photo Album Plus = 9.3.02.002 versions...

CVE-2026-93774 WordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WP Photo Album Plus = 9.3.02.002 versions...

WordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP ERP versions = 1.17.9...

Exploit for CVE-2026-89274

CVE-2026-89274 - WP Recipe Maker Arbitrary Shortcode Execution...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the updatePost process. An attacker can alter the publication status or content of their own posts without the required editorial approval by submitting crafted GraphQL mutations as an authenticated Contributo...

New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control

A flaw in cPanel's CalDAV and CardDAV service lets anyone with a cPanel hosting account run code as root and take "full control of the server," the company said on September 22. A second bug in the WP Toolkit plugin, used to install and manage WordPress sites, allows an account holder to change...

WordPress Mang Board WP plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dcs in WordPress Plugin Mang Board WP versions = 2.4.1...

WordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin WP Photo Album Plus versions = 9.3.02.002...

WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability

Bypass Vulnerability vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP User Frontend versions = 4.3.11...

WordPress WP User Frontend plugin <= 4.3.11 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP User Frontend versions = 4.3.11...

CVE-2026-86601

The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes...

WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability

Bypass Vulnerability vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP User Frontend versions = 4.3.11...