WordPress WP Directory Kit plugin < 1.5.5 - Subscriber+ Plugin Settings and API Key Disclosure vulnerability

Subscriber+ Plugin Settings and API Key Disclosure vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin WP Directory Kit versions 1.5.5...

WordPress WP Directory Kit plugin < 1.5.5 - Subscriber+ Contact Message and User Data Disclosure vulnerability

Subscriber+ Contact Message and User Data Disclosure vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin WP Directory Kit versions 1.5.5...

WordPress WP Directory Kit plugin < 1.5.5 - Subscriber+ User and Unpublished Listing Disclosure vulnerability

Subscriber+ User and Unpublished Listing Disclosure vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin WP Directory Kit versions 1.5.5...

WordPress WP Statistics plugin < 14.16.10 - Subscriber+ Sensitive Data Disclosure via Metabox AJAX Handlers vulnerability

Subscriber+ Sensitive Data Disclosure via Metabox AJAX Handlers vulnerability discovered by Shivamani Vastrala in WordPress Plugin WP Statistics versions 14.16.10...

CVE-2026-19715

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

EUVD-2026-66876

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

CVE-2026-19715 WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

CVE-2026-19715 WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

CVE-2026-19715

The WP OAuth Server ( Login with WordPress ) WordPress plugin in versions before 6.3.1 is vulnerable to an unauthenticated information disclosure. When debug logging is enabled, the plugin writes to a debug log stored at a fixed and publicly reachable location without restricting access. This all...

CVE-2026-19715: Exposure of Sensitive Information to an Unauthorized Actor

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

PT-2026-82392

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

CVE-2026-78293: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WP w3all phpBB = 3.0.6 versions...

CVE-2026-76549: Cross-Site Request Forgery (CSRF)

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a...

WordPress WP Maps plugin < 4.9.7 - Subscriber+ Denial of Service vulnerability

Subscriber+ Denial of Service vulnerability discovered by Mohammad Aghdasi in WordPress Plugin WP Maps versions 4.9.7...

WordPress WP Fastest Cache plugin <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Host Header vulnerability

Unauthenticated Stored Cross-Site Scripting via HTTP Host Header vulnerability discovered by Adrien Brunner in WordPress Plugin WP Fastest Cache versions = 1.5.0...

CVE-2026-3235

The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'checkappaccess' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from...

EUVD-2026-66407

The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'checkappaccess' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from...

CVE-2026-3235 WP Data Access – No-Code App Builder with Tables, Forms, Charts & Maps <= 5.5.68 - Unauthenticated Insecure Direct Object Reference to Data Access

The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'checkappaccess' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from...

CVE-2026-3235

The WP Data Access plugin for WordPress is vulnerable to an unauthenticated Insecure Direct Object Reference (IDOR) in all versions up to and including 5.5.68 . The flaw resides in the check_app_access function, where a mismatch between the authorization check (performed against app_id) and the d...

CVE-2026-3235 WP Data Access – No-Code App Builder with Tables, Forms, Charts & Maps <= 5.5.68 - Unauthenticated Insecure Direct Object Reference to Data Access

The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'checkappaccess' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from...