CVE-2026-19857

The Formidable Forms WordPress plugin before version 6.35 is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is that a request-derived value can reach the WordPress shortcode parser when the plugin substitutes the [entry_key] token into a form's custom HTML, allowing ...

CVE-2026-13407

CVE-2026-13407 affects the Royal Elementor Addons WordPress plugin in versions before 1.7.1067 . The form widget does not properly sanitize and escape submitted values before including them in administrator notification emails, allowing unauthenticated attackers to inject arbitrary HTML into emai...

CVE-2026-73447

CVE-2026-73447 is a CRITICAL (CVSS 3.1: 9.1) OS command injection (CWE-78) in the gNSI Certz and Bootz services on Arista EOS . An authenticated user can escalate privileges to root via a crafted Certz Rotate request, leading to full device compromise . Affected versions span the 4.30.x through 4...

CVE-2026-89327

CVE-2026-89327 affects the FluentBoards WordPress plugin in versions prior to 2.0.15 . The root cause is a missing validation on the comment_by parameter: the plugin does not verify that the board member submitting a comment is actually the user the comment is attributed to. This allows any user ...

CVE-2026-87896

CVE-2026-87896 affects the Rox Appointment Booking WordPress plugin in versions prior to 1.2.8 . The vulnerability stems from a missing authorization check on a REST endpoint that returns booking agent (staff) records, allowing unauthenticated attackers to read sensitive staff data including emai...

CVE-2026-88910

kboard , a WordPress plugin for forum/notice board functionality, is vulnerable in versions before 6.7 to an unauthenticated IDOR (Insecure Direct Object Reference) flaw in its board media deletion endpoint. The plugin fails to verify ownership or context before processing a media deletion reques...

CVE-2026-87959

The WPBot WordPress plugin (versions 8.7.2–8.7.5 ) contains a missing capability check on the AJAX action that saves its Claude AI provider settings . This allows users with subscriber-level access to overwrite those settings, including the API key used for the plugin's outgoing AI requests, as d...

CVE-2026-89328

The FluentBoards WordPress plugin prior to 2.0.15 contains a privilege-escalation flaw in its board-management logic. The plugin checks only board membership rather than verifying board-manager privileges before allowing several management operations. As a result, any board member can perform man...

CVE-2026-87907

CVE-2026-87907 affects the Rox Appointment Booking WordPress plugin in versions prior to 1.2.8 . The root cause is a missing authorization check on the REST endpoints that return booking service and category records. This allows unauthenticated attackers to read private internal notes stored on e...

CVE-2026-87854

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints , enabling unauthenticated users to retrieve the store's full subscription list, including customer usernames, product names, recurring amounts, and p...

CVE-2026-87828

Seraphinite Accelerator is a WordPress plugin that, in versions before 2.29.24 , fails to perform a capability check on its seraph_accel_State Update AJAX action. An authenticated user with at least Subscriber level can write a malformed value through this action, triggering an uncaught error on ...

CVE-2026-86784

The Visualizer WordPress plugin (versions before 4.0.8 ) contains a stored XSS vulnerability. The chart's JSON data source configuration is not sanitised or escaped before being output in the chart editor, allowing users with the Contributor role or above to inject JavaScript that executes in the...

CVE-2026-87860

CVE-2026-87860 affects the Subscriptions for WooCommerce WordPress plugin in versions before 2.0.3 . The plugin does not verify the security token on the request that cancels a subscription, resulting in a CSRF flaw. An attacker can craft a request that tricks a logged-in customer into cancelling...

CVE-2026-86823

The Newsletter WordPress plugin before 9.3.7 fails to validate the redirect destination performed after a public subscription action (via the ncu parameter). This allows unauthenticated attackers to redirect users to arbitrary external sites and disclose a subscriber token that grants access to t...

CVE-2026-86448

The LearnPress WordPress plugin (versions 4.3.2.8 through 4.4.6 ) fails to perform any authentication, capability, or nonce check before serving a previously generated order export file via the lp_download_order function. This allows unauthenticated attackers who can determine the file identifier...

CVE-2026-86447

The LearnPress WordPress plugin (before 4.4.7 , specifically version 4.4.6 ) contains a missing capability check in the load_content_via_ajax handler, an administrative course tool. This allows unauthenticated attackers to enumerate enrolled students' display names and user identifiers per course...

CVE-2026-86445

The LearnPress WordPress plugin (versions 4.2.9–4.4.6 ) contains an unauthenticated information disclosure in its load_content_via_ajax administrative template handler, which fails to verify user capabilities. Attackers can retrieve the text, identifier, and type of every published quiz question,...

CVE-2026-86449

LearnPress WordPress plugin versions 4.2.7.1 through 4.4.6 fail to verify user capabilities before applying a user-supplied post status filter in one of its REST routes. This allows unauthenticated attackers to enumerate unpublished courses, including those in draft, pending, private, scheduled, ...

CVE-2026-85572

Tutor LMS WordPress plugin versions 4.0.0 through 4.0.7 fail to verify that a user has access to a course before returning its lesson discussion content . This allows any authenticated user—even a subscriber role—to read comments from courses they are not enrolled in, including comments awaiting ...

CVE-2026-86444

LearnPress WordPress plugin (versions 4.2.6.4–4.4.6 ) contains a reflected XSS vulnerability via the 'skin' parameter. A user-supplied value is not escaped before being placed in an HTML attribute on a public page, allowing unauthenticated attackers to inject arbitrary JavaScript by luring a vict...