CVE-2026-88910

kboard , a WordPress plugin for forum/notice board functionality, is vulnerable in versions before 6.7 to an unauthenticated IDOR (Insecure Direct Object Reference) flaw in its board media deletion endpoint. The plugin fails to verify ownership or context before processing a media deletion reques...

CVE-2026-89328

The FluentBoards WordPress plugin prior to 2.0.15 contains a privilege-escalation flaw in its board-management logic. The plugin checks only board membership rather than verifying board-manager privileges before allowing several management operations. As a result, any board member can perform man...

CVE-2026-87907

CVE-2026-87907 affects the Rox Appointment Booking WordPress plugin in versions prior to 1.2.8 . The root cause is a missing authorization check on the REST endpoints that return booking service and category records. This allows unauthenticated attackers to read private internal notes stored on e...

CVE-2026-87828

Seraphinite Accelerator is a WordPress plugin that, in versions before 2.29.24 , fails to perform a capability check on its seraph_accel_State Update AJAX action. An authenticated user with at least Subscriber level can write a malformed value through this action, triggering an uncaught error on ...

CVE-2026-87854

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints , enabling unauthenticated users to retrieve the store's full subscription list, including customer usernames, product names, recurring amounts, and p...

CVE-2026-86784

The Visualizer WordPress plugin (versions before 4.0.8 ) contains a stored XSS vulnerability. The chart's JSON data source configuration is not sanitised or escaped before being output in the chart editor, allowing users with the Contributor role or above to inject JavaScript that executes in the...

CVE-2026-87860

CVE-2026-87860 affects the Subscriptions for WooCommerce WordPress plugin in versions before 2.0.3 . The plugin does not verify the security token on the request that cancels a subscription, resulting in a CSRF flaw. An attacker can craft a request that tricks a logged-in customer into cancelling...

CVE-2026-86823

The Newsletter WordPress plugin before 9.3.7 fails to validate the redirect destination performed after a public subscription action (via the ncu parameter). This allows unauthenticated attackers to redirect users to arbitrary external sites and disclose a subscriber token that grants access to t...

CVE-2026-86448

The LearnPress WordPress plugin (versions 4.3.2.8 through 4.4.6 ) fails to perform any authentication, capability, or nonce check before serving a previously generated order export file via the lp_download_order function. This allows unauthenticated attackers who can determine the file identifier...

CVE-2026-86447

The LearnPress WordPress plugin (before 4.4.7 , specifically version 4.4.6 ) contains a missing capability check in the load_content_via_ajax handler, an administrative course tool. This allows unauthenticated attackers to enumerate enrolled students' display names and user identifiers per course...

CVE-2026-86445

The LearnPress WordPress plugin (versions 4.2.9–4.4.6 ) contains an unauthenticated information disclosure in its load_content_via_ajax administrative template handler, which fails to verify user capabilities. Attackers can retrieve the text, identifier, and type of every published quiz question,...

CVE-2026-86449

LearnPress WordPress plugin versions 4.2.7.1 through 4.4.6 fail to verify user capabilities before applying a user-supplied post status filter in one of its REST routes. This allows unauthenticated attackers to enumerate unpublished courses, including those in draft, pending, private, scheduled, ...

CVE-2026-85572

Tutor LMS WordPress plugin versions 4.0.0 through 4.0.7 fail to verify that a user has access to a course before returning its lesson discussion content . This allows any authenticated user—even a subscriber role—to read comments from courses they are not enrolled in, including comments awaiting ...

CVE-2026-86444

LearnPress WordPress plugin (versions 4.2.6.4–4.4.6 ) contains a reflected XSS vulnerability via the 'skin' parameter. A user-supplied value is not escaped before being placed in an HTML attribute on a public page, allowing unauthenticated attackers to inject arbitrary JavaScript by luring a vict...

CVE-2026-85530

GiveWP is a popular WordPress donations plugin. Versions 4.16.6 through 4.16.8.0 contain an unauthenticated account takeover vulnerability (discovered by Jakub Herman). The root cause is an inconsistent normalization of a donor's e-mail address between the stored value and the value used in subse...

CVE-2026-85569

Tutor LMS WordPress plugin (versions 2.7.1 through

CVE-2026-85641

Formidable Forms WordPress plugin versions before 6.35 are affected by an unauthenticated stored content injection vulnerability via the updated_by parameter. The plugin does not restrict who can set the identifier that records which user last edited a form entry, and it relies on that identifier...

CVE-2026-85349

CVE-2026-85349 affects the FluentBoards WordPress plugin prior to version 2.0.15 . The root cause is an insecure direct object reference (IDOR) : the plugin fails to properly verify authorization when returning the list of boards a user belongs to. This allows any authenticated user at the Subscr...

CVE-2026-84088

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin (versions before 1.7.9 ) is vulnerable to a stored cross-site scripting (XSS) flaw in the Interactive Circle Widget . The plugin fails to validate or sanitize a widget link setting before embedding it in a JavaScript navigation call. A...

CVE-2026-85131

WPLP Cookie Consent (WordPress plugin, also known as WP Cookie Notice for GDPR, CCPA & ePrivacy Consent) versions before 4.4.4 are vulnerable to arbitrary post and page deletion via CSRF. The plugin fails to perform CSRF or capability checks when processing bulk actions on its administration scre...