WordPress WP Edit Password Protected plugin 2.0.0-2.0.6 - Unauthenticated Site-Wide Access Mode Bypass vulnerability

Unauthenticated Site-Wide Access Mode Bypass vulnerability discovered by Artus KG in WordPress Plugin Wp Edit Password Protected – Create Member/User Only Page & Design Password Protected Form versions 2.0.0-2.0.6...

CVE-2026-90952 WP Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated Site-Wide Access Mode Bypass via REST API

The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide...

CVE-2026-90952 WP Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated Site-Wide Access Mode Bypass via REST API

The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide...

EUVD-2026-91212

The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide...

CVE-2026-85005 Popup Maker WP 1.2.2.1 - 1.4.5 - Subscriber+ Zero-Argument PHP Callable Invocation via Missing Authorization

The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to any logged-in user, allowing users with a low-privileged role such as Subscriber to store display-targeting values that are later invoked as...

CVE-2026-85005 Popup Maker WP 1.2.2.1 - 1.4.5 - Subscriber+ Zero-Argument PHP Callable Invocation via Missing Authorization

The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to any logged-in user, allowing users with a low-privileged role such as Subscriber to store display-targeting values that are later invoked as...

WordPress Popup Maker WP plugin 1.2.2.1-1.4.5 - Subscriber+ Zero-Argument PHP Callable Invocation vulnerability

Subscriber+ Zero-Argument PHP Callable Invocation vulnerability discovered by Artus KG in WordPress Plugin Popup Maker WP versions 1.2.2.1-1.4.5...

CVE-2026-85005

The Popup Maker WP WordPress plugin (versions 1.2.2.1 through 1.4.5 ) is vulnerable to a Missing Authorization flaw. The plugin fails to perform adequate authorization checks on several actions, exposing its management page to any authenticated user. This allows users with low-privileged roles, s...

WordPress WP User Frontend plugin < 4.3.12 - Subscriber+ Post Creation vulnerability

Subscriber+ Post Creation vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP User Frontend versions 4.3.12...

CVE-2026-79618

The WP User Frontend WordPress plugin, prior to version 4.3.12 , fails to enforce subscription-purchase requirements in one of its post-creation handlers. This Missing Authorization (CWE-862) flaw allows authenticated users with subscriber-level access and above to create and, depending on specif...

CVE-2026-79618 WP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form

The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...

CVE-2026-79618 WP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form

The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...

EUVD-2026-91209

The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...

CVE-2026-1661 WP Mail Logging < 1.17.0 - Unauthenticated HTML Injection

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...

CVE-2026-1661 WP Mail Logging < 1.17.0 - Unauthenticated HTML Injection

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...

EUVD-2026-91208

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...

CVE-2026-1661

The WP Mail Logging WordPress plugin, in versions prior to 1.17.0 , is vulnerable to HTML injection because it fails to properly restrict the HTML and CSS of logged emails before rendering them in admin log screens. This allows unauthenticated users to inject styled content and links—for instance...

WordPress WP Statistics plugin <= 14.16.14 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by b1ue0cean in WordPress Plugin WP Statistics versions = 14.16.14...

CVE-2026-102565 BA Book Everything <= 1.8.28 - Unauthenticated Stored Cross-Site Scripting via 'booking_service_qty' Parameter

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bookingserviceqty' parameter in all versions up to, and including, 1.8.28 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

EUVD-2026-91203

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bookingserviceqty' parameter in all versions up to, and including, 1.8.28 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...