CVE-2026-91050

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to and including 5.7.2 . The vulnerability exists in the publicly reachable steps__start and steps__load_step routes, which accept a params[p...

CVE-2026-18496

The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 11.4.3 . The flaw exists within the wpbc_is_show_popover_in_flex_timeline() function, which allows unauthenticated attackers to extract sensitive customer data, including ...

CVE-2026-89301

The rtMedia for WordPress, BuddyPress and bbPress plugin is vulnerable in all versions up to and including 4.7.13 due to insufficient file path validation in the process function. This flaw allows unauthenticated attackers to perform limited file deletion of arbitrary safe files on the server via...

CVE-2026-97670

The Avada (Fusion) Builder plugin for WordPress (versions up to and including 7.16.1 ) is vulnerable to an authorization bypass due to insufficient verification of a WordPress action hook name. Attackers can supply an arbitrary hook name via an attacker-supplied form-field value (specifically usi...

CVE-2026-104021

The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to and including 1.7.4 . The flaw exists in the fastcache_settings[cache_cookie_exclude][] parameter because the plugin registers the setting via register_setting() without a sanitize_callback. The bu...

CVE-2026-9696

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.3.58 . The root cause is insufficient input sanitization and output escaping involving the 'not_found' parameter within the wPDM_packages shortcode . An authenticated...

CVE-2026-103998

The Form Maker by 10Web WordPress plugin (versions up to and including 1.15.48 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping specifically involving the 'inputs' parameter array key . Unauthenticated attackers can ex...

CVE-2026-104724

The FireBox – WooCommerce Popup Builder plugin for WordPress is vulnerable to a generic SQL Injection in all versions up to and including 3.1.13 . The root cause is insufficient escaping on user-supplied parameters and a lack of sufficient preparation on existing SQL queries within the FireBox Fo...

CVE-2026-6723

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to and including 1.6.11.11 . The root cause is an appointment update REST API endpoint that fails to restrict which fields can be modified by to...

CVE-2026-103424

The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) in all versions up to and including 6.88 . The root cause is insufficient input sanitization and output escaping of the 'comment' parameter . An una...

CVE-2026-103964

The Download Manager plugin for WordPress (versions up to and including 3.3.71 ) is vulnerable to Sensitive Information Exposure via Email Template Token Injection in the first_name parameter. An authenticated attacker with subscriber-level access or higher can exploit this by triggering a Suspen...

CVE-2026-104735

The RSS Aggregator by Feedzy WordPress plugin (versions up to and including 5.2.10 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the Feedzy Loop Block Feed URL / RSS functionality. Authenticated attackers with ...

CVE-2026-87869

The Filter Everything — WordPress & WooCommerce Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in versions up to and including 1.9.6 . The root cause lies in the flrt_elementor_load_more_anchor() function, which fails to properly sanitize and escape input. Spec...

CVE-2026-5727

The Hello Plus plugin for WordPress is vulnerable to an authorization bypass in versions up to and including 1.7.7 . The root cause is the plugin's failure to properly verify user permissions when performing certain actions. This allows authenticated attackers with Contributor-level access (or hi...

CVE-2026-102401

The Download Manager plugin for WordPress (versions up to and including 3.3.71 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the 'regurl' shortcode attribute. An authenticated attacker with Contributor-level access ...

CVE-2026-97630

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 7.5.54.7212 . The root cause is insufficient input sanitization and output escaping specifically within an unquoted popup shortcode attribute . Authenticated ...

CVE-2026-101324

The Fluent Forms plugin for WordPress (versions

CVE-2026-103889

The 3D Product configurator for WooCommerce plugin for WordPress (versions

CVE-2026-96648

The Data Tables Generator by Supsystic WordPress plugin (versions up to and including 1.15.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the updateRows action, specifically affecting the Table Cell 'data' valu...

CVE-2026-104993

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress are vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.8.188 . The root cause is insufficient input sanitization and output escaping of the email (Contact Emai...