CVE-2026-74932 WP Fastest Cache 0.9.0.3 - 1.5.0 - Unauthenticated Stored XSS via Host Header Cache Poisoning

The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the URLs of the asset files it embeds in the pages it caches, and does not include that header in the cache key, allowing unauthenticated attackers to poison cached pages with references ...

CVE-2026-74932

WP Fastest Cache (WordPress plugin) versions before 1.5.1 fail to validate the Host header before using it to build URLs for asset files embedded in cached pages, and omit that header from the cache key. This allows an unauthenticated attacker to poison cached pages with references to an attacker...

EUVD-2026-65961

The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the URLs of the asset files it embeds in the pages it caches, and does not include that header in the cache key, allowing unauthenticated attackers to poison cached pages with references ...

CVE-2026-74932 WP Fastest Cache 0.9.0.3 - 1.5.0 - Unauthenticated Stored XSS via Host Header Cache Poisoning

The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the URLs of the asset files it embeds in the pages it caches, and does not include that header in the cache key, allowing unauthenticated attackers to poison cached pages with references ...

WordPress All-in-One WP Migration and Backup plugin <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution vulnerability

Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution vulnerability discovered by Jack Taylor in WordPress Plugin All-in-One WP Migration versions = 7.109...

WordPress Geo My WP plugin < 4.5.5.3 - Subscriber+ Arbitrary Geolocation Record Modification and Deletion via IDOR vulnerability

Subscriber+ Arbitrary Geolocation Record Modification and Deletion via IDOR vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin GEO my WordPress versions 4.5.5.3...

WordPress WP Hotel Booking plugin < 2.3.2 - Unauthenticated PayPal Payment Bypass vulnerability

Unauthenticated PayPal Payment Bypass vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Hotel Booking versions 2.3.2...

WordPress WP Hotel Booking plugin < 2.3.3 - Unauthenticated Payment Bypass via Price Manipulation vulnerability

Unauthenticated Payment Bypass via Price Manipulation vulnerability discovered by reconnaissance in WordPress Plugin WP Hotel Booking versions 2.3.3...

WordPress WP Crowdfunding plugin < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR vulnerability

Subscriber+ Order Data Disclosure via IDOR vulnerability discovered by Sajjad Haqi in WordPress Plugin WP Crowdfunding versions 2.2.1...

CVE-2026-19949

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

WordPress WP Go Maps plugin < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Marker ID vulnerability

Unauthenticated Sensitive Information Disclosure via Marker ID vulnerability discovered by Sudhanshu Chauhan RedHunt Labs in WordPress Plugin WP Go Maps versions 10.0.10...

CVE-2026-19949 All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-19949 All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

EUVD-2026-65463

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-19949

The All-in-One WP Migration and Backup WordPress plugin (all versions up to and including 7.109 ) is susceptible to a second-order SQL injection in its archive restore functionality, caused by insufficient escaping of a user-supplied parameter and inadequate preparation of the existing SQL query....

WordPress WP DSGVO Tools (GDPR) plugin < 3.1.40 - Unauthenticated Sensitive Information Disclosure via Subject Access Request vulnerability

Unauthenticated Sensitive Information Disclosure via Subject Access Request vulnerability discovered by Shivamani Vastrala in WordPress Plugin WP DSGVO Tools GDPR versions 3.1.40...

WordPress WP Support Plus Responsive Ticket System plugin <= 9.1.2 - Unauthenticated Support Ticket Access via Session Cookie Forgery vulnerability

Unauthenticated Support Ticket Access via Session Cookie Forgery vulnerability discovered by Kartik sharma in WordPress Plugin WP Support Plus Responsive Ticket System versions = 9.1.2...

WordPress Adminify plugin < 4.2.10 - Contributor+ Sensitive Information Disclosure via Global Search AJAX vulnerability

Contributor+ Sensitive Information Disclosure via Global Search AJAX vulnerability discovered by Vaibhav Narkhede in WordPress Plugin WP Adminify versions 4.2.10...

WordPress WP w3all phpBB plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by lanlv - HPT Vietnam Coporation in WordPress Plugin WP w3all phpBB versions = 3.0.6...

CVE-2026-78470

The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,...