CVE-2026-90474

MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it for access tokens...

CVE-2026-90473

msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue when processing MAP32 containers with large element counts. Attackers can supply a MAP32 element count at or above 0x40000000 that wraps when doubled, causing the parser cursor to desynchronize and...

CVE-2026-90472

msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger...

CVE-2026-89172

Microchip AN1044, AN953, and SW300052 cryptographic algorithms are subject to an improper protection of physical side channels vulnerability. Affected versions: AN1044 through A, AN953 through A, and SW300052 through 2.6. The attack requires physical access with high complexity and specific attac...

CVE-2026-11355

The DT LMS – elearning WordPress plugin (versions ≤ 1.1) is vulnerable to unauthorized modification of plugin settings due to missing capability checks on multiple AJAX handlers (dtlms_save_poc_settings, dtlms_save_skin_settings, dtlms_save_options_settings). These handlers are registered on the ...

CVE-2026-77161

The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to SQL Injection via Parameter Name in all versions up to and including 5.1.24 . The root cause is insufficient escaping on a user-supplied parameter and lack of sufficient preparation of the existing SQL query, allo...

CVE-2026-78175

Tutor LMS (WordPress eLearning plugin) is vulnerable to PHP Object Injection in versions up to and including 4.0.7 via the withdraw_method_field parameter of the tutor_save_withdraw_account AJAX handler. The handler relies solely on a nonce without capability checks, and a flaw in how esc_sql() h...

CVE-2026-78006

The Events Calendar WordPress plugin (versions ≤ 6.17.4 ) is vulnerable to unauthenticated Remote Code Execution via PHP Object Injection in the is_safe_widget_instance function. The root cause is a bypass of the unsafe-object guard: PHP magic methods fire during pre-parse, and enable_rendering_w...

CVE-2026-78159

The Events Calendar WordPress plugin (versions ≤ 6.17.3 ) is vulnerable to unauthenticated remote code execution via the Element_Classes::parse_array() function. Insufficient validation of the widget classes map allows a plain-array payload to bypass the is_safe_widget_instance() object check and...

CVE-2026-17585

The Royal Addons for Elementor WordPress plugin (versions ≤ 1.7.1066) is vulnerable to unauthenticated Sensitive Information Exposure via the 'wpr_keyword' parameter. An unfiltered meta_query LIKE in the AJAX search module allows attackers to perform character-by-character substring matching acro...

CVE-2026-85200

GEO my WP is a WordPress plugin vulnerable to an unauthenticated Local File Inclusion (LFI) in all versions up to and including 4.5.5.3 , via the gmw_posts_locator_ajax_info_window_loader function. An attacker can include and execute arbitrary .php files on the server, enabling bypass of access c...

CVE-2026-85198

The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO WordPress plugin is vulnerable to SQL injection via URL path in versions up to and including 4.2.1 , caused by insufficient escaping and lack of prepared statements on a user-supplied parameter. Despite the title referencing...

CVE-2026-16482

The rtMedia for WordPress, BuddyPress and bbPress plugin (up to and including 4.7.11 ) is vulnerable to an unauthenticated time-based blind SQL Injection via the compare parameter. The root cause lies in RTMediaQuery::query(), which merges $_REQUEST into the internal query while only validating t...

CVE-2026-87919

CVE-2026-87919 affects the Product XML Feed Manager for WooCommerce WordPress plugin in versions prior to 3.1.1 . The vulnerability stems from the plugin's product shortcode not restricting which object method it may call and not checking the user's capability over the targeted product. This allo...

CVE-2026-87894

CVE-2026-87894 affects the Rox Appointment Booking WordPress plugin, versions 1.0.9 through 1.2.2 . The vulnerability is an unauthenticated IDOR (Insecure Direct Object Reference) on the endpoint that returns a booking's confirmation details. Because the plugin performs no authorization check and...

CVE-2026-87918

The WPBot WordPress plugin (before version 8.5.7 ) fails to perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers. This allows unauthenticated attackers to trigger those third-party API calls and consume the associated cost using the si...

CVE-2026-87892

The Rox Appointment Booking WordPress plugin versions before 1.2.0 fail to verify the order total or the selected payment method against server-side pricing when creating a booking. This allows unauthenticated attackers to create confirmed bookings at an arbitrary price and bypass the site's conf...

CVE-2026-87916

WPBot WordPress plugin (versions 8.4.9 through 8.5.9) is affected by an unauthenticated PII disclosure vulnerability. The AJAX action that lists stored chat sessions performs no capability or nonce check, allowing any unauthenticated attacker to retrieve the name, email address, and phone number ...

CVE-2026-87759

The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role. This allows any authenticated user, such as a subscriber , to grant themselves the administrator role on a mul...

CVE-2026-87842

The Zonify WordPress plugin (versions prior to 1.0.5 ) fails to perform any capability or authentication check before returning the site's stored account login token. This allows unauthenticated attackers to retrieve the token and use it to authenticate to the site owner's linked service account,...

CVE-2026-87797

The Sprout Invoices WordPress plugin (also known as Client Invoicing by Sprout Invoices) is vulnerable to private note overwrite in versions prior to 20.8.16 . The root cause is a missing capability or ownership check on the AJAX action si_edit_private_note , which allows any authenticated user —...

CVE-2026-87888

CVE-2026-87888 affects the YayPricing WordPress plugin prior to version 3.5.7 . A missing authorization check on the save_page_data REST route (which saves pricing rules) allows users with the subscriber role or above to inject JavaScript that executes in the browser of an administrator who opens...

CVE-2026-87891

The Rox Appointment Booking WordPress plugin, versions before 1.2.0 , lacks a capability or authorization check when saving its holiday schedule via the REST API. This allows unauthenticated attackers to overwrite the dates the booking system treats as unavailable, potentially blocking legitimate...

CVE-2026-84099

wpStoreCart 5 (IDB Ecommerce) WordPress plugin through 5.0.7 is vulnerable to unauthenticated PHP object injection via the bundled wpsc-membership-pro add-on, specifically its paypal.php file. The endpoint fails to restrict the permitted classes during deserialization of user-supplied input, allo...

CVE-2026-85681

The WP Component WordPress plugin through version 2.2.4 lacks any capability or nonce checks on an action exposed to unauthenticated users. The action accepts both the option name and option value directly from the request, allowing an unauthenticated attacker to overwrite any site option . On a ...

CVE-2026-84047

The Album Cover Finder WordPress plugin, versions through 0.7.0 , is vulnerable to an unauthenticated SQL injection attack. The root cause is the improper sanitization and escaping of the and_action parameter before it is used in a SQL query. Because no authentication is required, any visitor to ...

CVE-2026-84171

The Piclect WordPress plugin (versions through 1.0 ) has an unauthenticated arbitrary file upload vulnerability in its WP images upload feature. The plugin does not validate the name or type of uploaded files before writing them to a publicly accessible directory, allowing unauthenticated attacke...

CVE-2026-86790

The WP Highlight Box WordPress plugin (through version 1.0 ) is affected by a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is that some attributes of the highlight-box shortcode are not properly escaped before being output in the HTML of a page where the shortcode is embedded. ...

CVE-2026-84024

BEAR – Bulk Editor and Products Manager Professional for WooCommerce is a WordPress plugin vulnerable to CSRF in versions prior to 1.2.2 . The plugin fails to verify a CSRF nonce before saving its meta field configuration, allowing an attacker to overwrite that configuration by tricking a logged-...

CVE-2026-82847

Masteriyo LMS is a WordPress plugin that, in versions before 3.4.1 , fails to sanitise and escape one of its course fields (identified as Course Highlights in the CVELIST entry) before outputting it in the course editor. The root cause is the missing sanitisation and escape of user-supplied data....

CVE-2026-82851

Masteriyo LMS (WordPress plugin, versions 1.14.0 through 3.4.0 ) is affected by an Insecure Direct Object Reference (IDOR) vulnerability in its download endpoint. The plugin fails to verify ownership of, or restrict the type of, records requested for download. As a result, any user with the instr...

CVE-2026-84025

BEAR – Bulk Editor and Products Manager Professional for WooCommerce (WordPress plugin) versions before 1.2.2 are affected by an IDOR (Insecure Direct Object Reference) vulnerability. Several API handlers that return product data by a user-supplied identifier fail to perform ownership checks, all...

CVE-2026-84023

BEAR – Bulk Editor and Products Manager Professional for WooCommerce (versions before 1.2.2 ) fails to verify a CSRF nonce or check user capabilities before updating taxonomy terms. An attacker can exploit this by tricking a logged-in privileged user into visiting a crafted page, resulting in arb...

CVE-2026-81429

The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 is vulnerable to Stored XSS via a missing CSRF check on its template-import feature. Because the plugin does not sanitise imported data before storing and echoing it back, an attacker can craft a forged request that tricks a...

CVE-2026-81742

The BE REST Endpoints WordPress plugin through 1.0.0 allows unauthenticated users to read, create, update, and delete widgets without any authorization check. Additionally, the plugin fails to sanitize stored widget values , enabling injection of arbitrary web scripts that execute in the browser ...

CVE-2026-82845

The Masteriyo LMS WordPress plugin (versions before 3.4.1 ) fails to sanitize user-supplied metadata values before deserializing them upon read-back. An authenticated user with a minimal account can inject arbitrary PHP objects, leveraging a class in a bundled library to write and execute arbitra...

CVE-2026-81402

The DS Ad Rotator WordPress plugin (through version 0.8 ) has an unauthenticated arbitrary file upload vulnerability in its image upload handler. The handler performs no capability check , nonce verification , or file-type validation , allowing unauthenticated attackers to upload arbitrary files—...

CVE-2026-80491

The SAMO Forms WordPress plugin through version 1.0.0 is affected by a SQL injection vulnerability caused by improper sanitisation and escaping of user input before it is used in SQL queries across several unauthenticated actions. This allows unauthenticated attackers to execute arbitrary SQL, po...

CVE-2026-77752

Temporary Login Without Password (WordPress plugin, versions 1.5–1.9.8 ) contains a privilege escalation flaw: the plugin fails to verify that the user requesting a temporary login already holds network super admin rights before granting those rights to the new or existing account. On a multisite...

CVE-2026-80494

The Yogeta WP Cloud WordPress plugin through version 1.0 is affected by an unauthenticated arbitrary file download vulnerability. The root cause is that the plugin does not validate a user-supplied file path before passing it to a file-read function on a public endpoint that lacks any authorizati...

CVE-2026-78152

The SureRank SEO WordPress plugin (versions 1.6.2 through 1.10.0 ) outputs Person Schema structured data on public pages that includes registered user email addresses by default. Because this data is not excluded by default, unauthenticated visitors can harvest the email address of any user who h...

CVE-2026-81090

The Gpx2Graphics WordPress plugin, versions through 0.3 , fails to perform a CSRF check and does not validate the file type when handling file uploads. An attacker can exploit this by tricking a logged-in administrator into uploading an arbitrary file (e.g., a PHP script) via a crafted CSRF reque...

CVE-2026-77753

The Temporary Login Without Password WordPress plugin before 1.9.9 fails to prevent a temporary user from creating an Application Password , and fails to revoke that password when the temporary access expires or is disabled. As a result, the recipient of a temporary login retains working access t...

CVE-2026-77005

The CODE MONKEYS PROPOSALS WordPress plugin (through 1.0.1 ) fails to validate a user-supplied file path before performing a file deletion and does not check the capability of the requesting user. This allows any authenticated user , including low-privilege roles such as Subscriber , to delete ar...

CVE-2026-77006

The WebTotem Backups WordPress plugin (through version 1.0.1 ) suffers from arbitrary file deletion via path traversal exploitable by any authenticated user at the subscriber level or above. Three combined weaknesses enable this: the plugin does not validate a user-supplied file path, does not ch...

CVE-2026-77689

Booking for Appointments and Events Calendar (also referenced as Amelia Pro ) is a WordPress plugin affected in versions 9.0 through 9.8 (before 9.8.1). The vulnerability stems from the plugin not verifying that a payment was actually collected before recording a booking as paid. It trusts the pa...

CVE-2026-77705

CVE-2026-77705 affects the Booking for Appointments and Events Calendar WordPress plugin (also known as Amelia ) in versions prior to 2.4.10 . The vulnerability stems from a missing authorization check when editing a customer or employee record: the plugin does not verify that the user performing...

CVE-2026-75800

The Frontegg SAML SSO WordPress plugin through version 1.0.1 fails to verify the signature or issuer of SAML authentication responses before establishing a user session. This lack of validation allows unauthenticated attackers to take over any account, including administrators , or to create arbi...

CVE-2026-83532

Custom Menu Wizard Widget is a WordPress plugin affected through version 3.3.1 by a stored cross-site scripting (XSS) vulnerability. The root cause is the failure to sanitize and escape several shortcode attributes before rendering them into HTML. Any user with contributor-level access or above c...

CVE-2026-85706

CVE-2026-85706 is a CVSS 10.0 path traversal and missing-authentication flaw in GitLab CE/EE affecting versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 . The root cause is a percent-decoding differential: Workhorse matches its route regex against EscapedPath() without ...