WordPress WP Event SOlution plugin <= 4.1.19 - Arbitrary Content Deletion vulnerability

Arbitrary Content Deletion vulnerability discovered by VanTastic in WordPress Plugin WP Event SOlution versions = 4.1.19...

WordPress WP Event SOlution plugin <= 4.1.18 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by VanTastic in WordPress Plugin WP Event SOlution versions = 4.1.18...

WordPress Mang Board WP plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by etomixer in WordPress Plugin Mang Board WP versions = 2.3.4...

WordPress Eventin plugin < 4.1.20 - Contributor+ Order Information Disclosure via IDOR vulnerability

Contributor+ Order Information Disclosure via IDOR vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WP Event SOlution versions 4.1.20...

WordPress Eventin plugin < 4.1.20 - Contributor+ Customer PII Disclosure via REST API vulnerability

Contributor+ Customer PII Disclosure via REST API vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Event SOlution versions 4.1.20...

WordPress WP Photo Album Plus plugin < 9.2.04.003 - Subscriber+ Stored XSS vulnerability

Subscriber+ Stored XSS vulnerability discovered by Sai Praneeth Koti in WordPress Plugin WP Photo Album Plus versions 9.2.04.003...

CVE-2026-18945

The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...

CVE-2026-18945

The WP Helper Premium WordPress plugin (versions before 4.7.6 ) is vulnerable to an authorization bypass due to a missing order key validation . The flaw occurs when the plugin renders its custom order confirmation page or handles related AJAX actions. This allows unauthenticated users to view se...

CVE-2026-18945 WP Helper Premium < 4.7.6 - Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key Validation

The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...

CVE-2026-18945 WP Helper Premium < 4.7.6 - Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key Validation

The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...

CVE-2026-18945

The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...

EUVD-2026-57728

The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...

PT-2026-71506

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

PT-2026-71600

Author Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...

CVE-2026-27538: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

PT-2026-71501

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

CVE-2026-18945: Authorization Bypass Through User-Controlled Key

The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...

CVE-2026-28001: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

CVE-2026-61962: Improper Control of Generation of Code

Unauthenticated Arbitrary Code Execution in WP BASE Booking = 6.3.0 versions...

CVE-2026-61960: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WP Full Stripe Free = 8.5.0 versions...