CVE-2026-84757: Missing Authorization

Unauthenticated Settings Change in WP Compress = 7.21.28 versions...

PT-2026-85092

Unauthenticated Cross Site Scripting XSS in WP QuickLaTeX = 3.8.8 versions...

PT-2026-85111

Unauthenticated Cross Site Scripting XSS in WP Statistics = 14.16.11 versions...

CVE-2026-81776: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WP QuickLaTeX = 3.8.8 versions...

CVE-2026-84774: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WP Statistics = 14.16.11 versions...

CVE-2026-84762: External Control of Assumed-Immutable Web Parameter

Unauthenticated Bypass Vulnerability in WP EasyPay = 4.5.3 versions...

PT-2026-85103

Unauthenticated Bypass Vulnerability in WP EasyPay = 4.5.3 versions...

CVE-2026-83533

The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...

CVE-2025-8945

The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API...

EUVD-2025-210833

The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API...

CVE-2025-8945 Wp Edit Password Protected < 1.3.5 - Protection Bypass via REST API

The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API...

CVE-2025-8945 Wp Edit Password Protected < 1.3.5 - Protection Bypass via REST API

The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API...

CVE-2025-8945

The Wp Edit Password Protected WordPress plugin prior to version 1.3.5 provides page-level content protection that can be bypassed via the WordPress REST API , allowing an unauthenticated, remote attacker to access otherwise password-protected page content. The vulnerability requires no special p...

CVE-2026-83533 WP Express Checkout < 2.4.9 - Unauthenticated Payment Bypass via wpec_process_payment

The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...

EUVD-2026-70046

The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...

CVE-2026-83533

WP Express Checkout WordPress plugin before 2.4.9 contains an unauthenticated payment bypass in the wpec_process_payment handler. The plugin does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order...

CVE-2026-83533 WP Express Checkout < 2.4.9 - Unauthenticated Payment Bypass via wpec_process_payment

The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...

CVE-2026-17563 WP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated Form

The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through...

CVE-2026-17563

User Frontend WordPress plugin (versions before 4.3.11 ) enforces its subscription-purchase requirement only when rendering a frontend form, not when processing the actual post submission. This allows unauthenticated users to create—and, depending on form configuration, immediately publish —posts...

CVE-2026-17563 WP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated Form

The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through...