CVE-2026-74012

Editor PHP Object Injection in TaxoPress = 3.51.0 versions...

CVE-2026-74009

Unauthenticated Insecure Direct Object References IDOR in Razorpay for WooCommerce = 4.8.7 versions...

CVE-2026-73994

Unauthenticated Broken Access Control in Charitable = 1.8.11.3 versions...

CVE-2026-73996

Unauthenticated Arbitrary File Upload in Masteriyo - LMS = 2.3.2 versions...

CVE-2026-73997

Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP = 2.3.3 versions...

CVE-2026-74003

Contributor Broken Access Control in RomethemeForm For Elementor = 1.2.6 versions...

CVE-2026-73995

Subscriber Broken Authentication in User Registration = 5.2.6 versions...

CVE-2026-73426

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing a data-trix-serialized-attributes...

CVE-2026-73398

Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions...

CVE-2026-73399

Unauthenticated Broken Authentication in Flutterwave WooCommerce = 3.3.0 versions...

CVE-2026-73404

Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...

CVE-2026-73397

Unauthenticated Deserialization of untrusted data in Youzify = 1.3.7 versions...

CVE-2026-73400

Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress = 2.4.11 versions...

CVE-2026-73392

Unauthenticated SQL Injection in Super Store Finder = 7.8 versions...

CVE-2026-73396

Subscriber Broken Authentication in MWB HubSpot for WooCommerce = 1.6.7 versions...

CVE-2026-73383

Shop manager Arbitrary File Download in CTX Feed = 6.6.47 versions...

CVE-2026-73393

Unauthenticated Cross Site Scripting XSS in Subscribe2 = 10.46 versions...

CVE-2026-73380

Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...

CVE-2026-73395

Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...

CVE-2026-73381

Unauthenticated Broken Authentication in Popup by Supsystic = 1.13.0 versions...

CVE-2026-73382

Unauthenticated Cross Site Scripting XSS in Site Reviews = 8.2.0 versions...

CVE-2026-73375

Unauthenticated Cross Site Scripting XSS in Ultimate Maps by Supsystic 1.5.0 versions...

CVE-2026-73379

Unauthenticated Bypass Vulnerability in Contact Form by Supsystic 1.10.0 versions...

CVE-2026-73367

Unauthenticated Remote File Inclusion in Easy Google Maps 1.14.2 versions...

CVE-2026-73376

Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic 1.5.0 versions...

CVE-2026-73377

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic 1.5.0 versions...

CVE-2026-73378

Unauthenticated Cross Site Scripting XSS in Contact Form by Supsystic 1.10.0 versions...

CVE-2026-73358

Unauthenticated Cross Site Scripting XSS in Affiliates Manager = 2.9.53 versions...

CVE-2026-73360

Unauthenticated Cross Site Scripting XSS in Chaty Pro = 3.5.8 versions...

CVE-2026-73365

Unauthenticated SQL Injection in JetAppointment = 2.5.2 versions...

CVE-2026-73359

Subscriber Cross Site Scripting XSS in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent = 4.3.9 versions...

CVE-2026-73366

Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...

CVE-2026-73361

Unauthenticated Cross Site Scripting XSS in Recipe Card Blocks for Gutenberg & Elementor = 3.4.18 versions...

CVE-2026-73362

Unauthenticated Cross Site Scripting XSS in URL Shortify = 2.5.0 versions...

CVE-2026-73345

Customer SQL Injection in License Manager for WooCommerce = 3.0.18 versions...

CVE-2026-73351

Unauthenticated Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.1 versions...

CVE-2026-73355

Unauthenticated SQL Injection in Affiliates Manager = 2.9.53 versions...

CVE-2026-73348

Unauthenticated Broken Access Control in GiveWP 4.16.6 versions...

CVE-2026-73350

Unauthenticated Broken Authentication in SupportCandy = 3.5.1 versions...

CVE-2026-73352

Unauthenticated Broken Access Control in GiveWP = 4.16.5.1 versions...

CVE-2026-73356

Unauthenticated Arbitrary Content Deletion in Breeze = 2.5.12 versions...

CVE-2026-73189

Subscriber Insecure Direct Object References IDOR in WP Crowdfunding 2.2.1 versions...

CVE-2026-73338

Unauthenticated Cross Site Scripting XSS in Autopay = 5.0.0 versions...

CVE-2026-73343

Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...

CVE-2026-73339

Unauthenticated SQL Injection in Modern Events Calendar 7.35.0 versions...

CVE-2026-73341

Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...

CVE-2026-73342

Unauthenticated Cross Site Scripting XSS in WP Multilang = 2.4.31 versions...

CVE-2026-73190

Unauthenticated Cross Site Scripting XSS in WPDM – Premium Packages = 7.0.5 versions...

CVE-2026-70657

Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder. This vulnerability was only reachable if both...

CVE-2026-71539

n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a...