CVE-2026-17607

WP Inventory Manager plugin for WordPress (versions ≤ 2.5.1) is vulnerable to SQL Injection via the 'where' attribute of the [wpinventory] shortcode. The root cause is in the WPIMItem::get_all() function, where parse_custom_where() performs only html_entity_decode(), semicolon stripping, and fiel...

CVE-2026-18442

WCFM Marketplace – Multivendor Marketplace for WooCommerce (WordPress plugin) is vulnerable to unauthenticated SQL injection via the 'wcfmmp_user_location_lng' and 'wcfmmp_user_location_lat' parameters in all versions up to, and including, 3.8.2 . The root cause is insufficient escaping on user-s...

CVE-2026-17586

The VK All in One Expansion Unit WordPress plugin (versions up to and including 9.118.0 ) is vulnerable to Stored Cross-Site Scripting via the vkExUnit_cta_img_position post meta field. The root cause is insufficient input sanitization and output escaping: the sanitize_text_field callback on save...

CVE-2026-93494

CVE-2026-93494 affects Netty's StompSubframeDecoder in the netty-codec-stomp component. A remote attacker can send a specially crafted STOMP frame body missing its terminating null byte , causing the decoder to allocate a ByteBuf that is never released . This results in a permanent memory leak th...

CVE-2026-89058

RESTEasy 's CorsFilter contains a cross-origin policy flaw: when configured with the wildcard origin "*", it reflects the request's Origin header back in the Access-Control-Allow-Origin response while also setting Access-Control-Allow-Credentials: true. This allows a malicious website to make cre...

CVE-2026-89059

RESTEasy's IIOImageProvider (in resteasy-core) decodes attacker-supplied image request bodies without enforcing any limit on declared image dimensions or pixel count. A remote, unauthenticated attacker over the network can send a small crafted image declaring enormous dimensions, triggering a ver...

CVE-2024-38639

CVE-2024-38639 is an improper authentication vulnerability affecting a QNAP product (identified by the CVELIST title referencing QTS and the QNAP security advisory QSA-24-37). The description explicitly states that QTS is not affected , and the vendor reports the vulnerability has been fixed in a...

CVE-2024-27123

CVE-2024-27123 is a cross-site scripting (XSS) vulnerability in QcalAgent , a QNAP component. Local attackers with active user interaction can exploit it to bypass security mechanisms or read application data , resulting in high confidentiality impact and low integrity impact on the vulnerable sy...

CVE-2026-89330

The EmbedPress WordPress plugin (PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos) is affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the 'unique' parameter , impacting all versions up to and including 4.6.5 . The root cause is insufficient input sanitization and ...

CVE-2026-89278

GPTranslate – Multilingual AI Translation Agent for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 2.34.6 . The plugin's enqueue_frontend_scripts function embeds a plaintext third-party AI provider API key (OpenAI, DeepL, xAI/Grok, Gemini, Claude, or...

CVE-2026-92561

The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the 'options' parameter in all versions up to and including 11.8.2 . The root cause is insufficient input sanitization and output escaping in the timeline v2 component (wpbc-class-timeline_v2.php)....

CVE-2026-84909

The Custom Twitter Feeds WordPress plugin (Tweets Widget / X Feed Widget) is vulnerable to Stored Cross-Site Scripting via the 'buttoncolor' shortcode attribute in all versions up to and including 2.8.0 , caused by insufficient input sanitization and output escaping . Authenticated attackers with...

CVE-2026-12106

The Auto Upload Images plugin for WordPress (all versions up to and including 3.3.2 ) is vulnerable to a Limited Server-Side Request Forgery (SSRF) via the downloadImage function. The root cause is the use of wp_remote_get() instead of wp_safe_remote_get(), combined with a validate() method that ...

CVE-2026-75017

CVE-2026-75017 affects the Magazine Blocks WordPress plugin in all versions up to and including 1.8.6 . The vulnerability is an authorization bypass caused by the mzb-builder-template post type being registered with capability_type='post' and exposed via the REST API, allowing any user with Contr...

CVE-2026-92619

The Booking Calendar plugin for WordPress (all versions up to 11.8.2 ) is vulnerable to Privilege Escalation via the wpbc_ajax_option_save AJAX action. The root cause is that handle_ajax_save() only enforces per-option safeguards for names registered via register_option_policy(); any unregistered...

CVE-2026-89138

The Filter Gallery plugin for WordPress is affected by an authorization bypass in all versions up to and including 1.1.4 . The root cause is a missing authorization check in the ufg_save_gallery AJAX action, specifically via the image_id parameter. This allows authenticated attackers with subscri...

CVE-2026-91707

The Divi theme for WordPress (versions up to and including 5.11.1 ) contains an arbitrary shortcode execution flaw caused by missing authorization on the content parameter via the Shortcode Module REST Endpoint . The value is not properly validated before being passed to do_shortcode, allowing un...

CVE-2026-75016

The Magazine Blocks plugin for WordPress (versions up to and including 1.8.6 ) is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the NewsTicker::render() method. The root cause is insufficient input sanitization and output escaping: the clientId block attribute is concatenated i...

CVE-2026-18317

Foxtool All-in-One: Contact chat button, Custom login, Media optimize images WordPress plugin (versions ≤ 2.5.3 ) contains an authorization bypass in the toggle_watermark AJAX action. The plugin fails to properly verify that the requesting user is authorized to perform the action via the option_k...

CVE-2026-92714

CVE-2026-92714 affects the Download Manager WordPress plugin (versions ≤ 3.3.68) with an Insecure Direct Object Reference (IDOR) in the duplicate() function hooked on admin_init. The handler only checks the generic edit_posts capability and a plugin-wide static nonce, without an object-level auth...

CVE-2026-17576

The InfiniteWP Client WordPress plugin (versions ≤ 1.13.9) is vulnerable to SQL Injection via the get_comments action. The root cause is insufficient escaping on JSON request-body array-key names: IWP_MMB_Comment::get_comments() strips the iwp_get_comments_ prefix from keys, wraps the remainder i...

CVE-2026-89413

The Filter Gallery plugin for WordPress (versions ≤ 1.1.4) suffers from an authorization bypass due to improper verification of user authorization before performing a deletion action. Authenticated users with subscriber-level access or above can delete arbitrary gallery records—including associat...

CVE-2026-90977

The Clean Login WordPress plugin prior to version 1.19 fails to verify the registration CAPTCHA when the stored session value is empty. This allows unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving the CAPTCHA. The vulnerabili...

CVE-2026-90976

The Clean Login WordPress plugin before version 1.19 contains a flaw in its registration handler: it does not verify whether user registration is enabled before creating an account. This allows unauthenticated users to create accounts on sites where registration has been disabled, resulting in a ...

CVE-2026-86800

The Hide My WP Ghost WordPress plugin prior to 7.0.11 fails to properly validate a loopback security-check request before disabling its login and URL hiding protection. Because the verification value is not correctly checked, any unauthenticated visitor can craft a request with a missing or incor...

CVE-2026-88994

The All Bootstrap Blocks WordPress plugin (versions 1.3.20 through 1.3.31 ) contains a Local File Inclusion (LFI) vulnerability in its Lightspeed subsystem. A block attribute is used to build a filesystem path that is included at render time without validation, allowing users with contributor-lev...

CVE-2026-86796

Hide My WP Ghost (WP Ghost) WordPress plugin versions before 7.0.11 contain an unauthenticated bypass of its firewall, threat-detection, and login/URL-hiding protections. The root cause is that the plugin does not verify a request is a genuine WooCommerce request before disabling those protection...

CVE-2026-79713

Breeze Cache (WordPress plugin, versions 1.2.5 through 2.5.14 ) is vulnerable to unauthenticated cache poisoning caused by a missing set of tracking-related query parameters in its page-cache key . Because pages requested with those parameters are still cached and served from the clean URL's cach...

CVE-2026-90978

The Filter Gallery WordPress plugin (versions before 1.1.5 ) is vulnerable to improper access control due to a fail-open nonce check . Several AJAX handlers fail to verify nonces when the field is omitted and do not perform capability checks. This allows low-privileged users (such as subscribers)...

CVE-2026-90984

The Generate PDF using Contact Form 7 WordPress plugin (versions before 4.2.2 ) is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) . The issue arises because the plugin's PDF renderer does not restrict the destination of image fetches performed on submitted form content. An at...

CVE-2026-89008

The Bookit — Booking & Appointment Calendar WordPress plugin, in versions prior to 2.6.0.5 , fails to perform adequate authorization checks on specific appointment-retrieval actions. This flaw allows users with low-privilege, plugin-specific roles to access and read the appointment records of oth...

CVE-2026-88993

The All Bootstrap Blocks WordPress plugin, affecting versions up to and including 1.3.31 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The issue arises because the plugin fails to properly escape a block attribute before outputting it into an HTML tag-name position . This allows us...

CVE-2026-88844

The MasterStudy LMS WordPress Plugin for WordPress (versions 3.6.2 to 3.7.49 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to verify if a requesting user owns a specific course before returning its enrolled-student data. This allows users with the Instructor...

CVE-2026-89007

The Bookit — Booking & Appointment Calendar WordPress plugin (versions before 2.6.0.5 ) is vulnerable to an authorization flaw. The plugin fails to perform a capability check within one of its appointment-deletion functions. This allows users assigned to the low-privileged custom Staff role to pe...

CVE-2026-88798

The Really Simple Security WordPress plugin (versions before 9.8.3 ) is vulnerable to an unbounded option growth flaw. The root cause is a failure to validate a client-supplied address value before using it as a storage key for one of the plugin's options. This allows unauthenticated attackers to...

CVE-2026-88825

The iGMS Direct Booking WordPress plugin (versions before 2.0 ) is vulnerable to an unauthenticated stored XSS flaw. The root cause is a failure to properly authorize or escape widget appearance settings. This allows unauthenticated users to store arbitrary web scripts that execute in the browser...

CVE-2026-87966

The Easy Appointments WordPress plugin, in versions 4.0 through 4.0.2.1 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The application fails to perform sufficient ownership or authorization checks on its unauthenticated appointment-reservation endpoint. This oversight allows an u...

CVE-2026-87775

The Tz Weekly Radio Schedule WordPress plugin (versions

CVE-2026-87965

The Easy Appointments WordPress plugin (versions before 4.0.2.2 ) is vulnerable to unauthenticated appointment cancellation and confirmation. The root cause is the use of guessable tokens for mail-link actions, as the plugin derives these tokens from a hardcoded source-embedded salt and the appoi...

CVE-2026-87767

The wp shortcut link and advertisement baner WordPress plugin (versions

CVE-2026-87770

The Price Drop Alert for WooCommerce WordPress plugin (versions

CVE-2026-87774

The Tz Weekly Radio Schedule WordPress plugin (versions through 1.8.1 ) is vulnerable to an unauthenticated SQL injection attack. The root cause is the failure to sanitize and escape a parameter before using it to construct a SQL query within an AJAX action accessible to unauthenticated users. An...

CVE-2026-87771

The Product Question and Answer WordPress plugin, in versions through 1.1.0 , is vulnerable to unauthenticated SQL injection . The root cause is a failure to sanitize and escape parameters before using them in SQL queries on AJAX actions accessible to unauthenticated users. An attacker can exploi...

CVE-2026-85350

The UpsellWP WordPress plugin (versions 1.4.4-2.2.9 ) is vulnerable to an unauthenticated price manipulation issue. The root cause is a failure to verify that products added to the cart via a Frequently Bought Together campaign actually belong to that specific campaign. This allows unauthenticate...

CVE-2026-85127

The VikBooking Hotel Booking Engine & PMS WordPress plugin, specifically versions 1.8.8 through 1.8.14 , is vulnerable to an unauthenticated stored XSS vulnerability. The flaw exists because the plugin fails to restrict file types or sanitize the contents of files attached by unauthenticated visi...

CVE-2026-85123

The Easy Form Builder by WhiteStudio WordPress plugin, versions 4.0.0-4.1.3 , is vulnerable to an unauthenticated registration policy bypass . The flaw exists because the plugin fails to validate submitted values against stored configurations for certain form types, specifically involving Login F...

CVE-2026-85122

The Easy Form Builder by WhiteStudio WordPress plugin, in versions before 4.2.0 (specifically identified as 4.0.0-4.1.3 in some records), is vulnerable to Stored XSS . The root cause is a failure to validate submitted values against stored configurations for certain form types. This allows unauth...

CVE-2026-84904

The King Addons for Elementor WordPress plugin (versions 51.1.56 through 51.1.80 ) contains an authorization flaw where it fails to perform per-object authorization checks on specific image-optimization actions. The plugin relies on coarse capabilities held by lower-privileged users without verif...

CVE-2026-84902

The King Addons for Elementor WordPress plugin, prior to version 51.1.81 , is vulnerable to Stored Cross-Site Scripting (XSS) and unauthorized content modification. The root cause is a lack of object-level authorization checks during the import of template content into a page. This allows users w...

CVE-2026-84903

The King Addons for Elementor WordPress plugin, in versions before 51.1.81 , is vulnerable to unauthorized disclosure of private post content. The root cause is a lack of capability, post-status, or password checks when rendering content from a user-supplied post via the kng_maintenance_page shor...