CVE-2026-86445

The LearnPress WordPress plugin (versions 4.2.9–4.4.6 ) contains an unauthenticated information disclosure in its load_content_via_ajax administrative template handler, which fails to verify user capabilities. Attackers can retrieve the text, identifier, and type of every published quiz question,...

CVE-2026-86449

LearnPress WordPress plugin versions 4.2.7.1 through 4.4.6 fail to verify user capabilities before applying a user-supplied post status filter in one of its REST routes. This allows unauthenticated attackers to enumerate unpublished courses, including those in draft, pending, private, scheduled, ...

CVE-2026-85572

Tutor LMS WordPress plugin versions 4.0.0 through 4.0.7 fail to verify that a user has access to a course before returning its lesson discussion content . This allows any authenticated user—even a subscriber role—to read comments from courses they are not enrolled in, including comments awaiting ...

CVE-2026-86444

LearnPress WordPress plugin (versions 4.2.6.4–4.4.6 ) contains a reflected XSS vulnerability via the 'skin' parameter. A user-supplied value is not escaped before being placed in an HTML attribute on a public page, allowing unauthenticated attackers to inject arbitrary JavaScript by luring a vict...

CVE-2026-85569

Tutor LMS WordPress plugin (versions 2.7.1 through

CVE-2026-85530

GiveWP is a popular WordPress donations plugin. Versions 4.16.6 through 4.16.8.0 contain an unauthenticated account takeover vulnerability (discovered by Jakub Herman). The root cause is an inconsistent normalization of a donor's e-mail address between the stored value and the value used in subse...

CVE-2026-85641

Formidable Forms WordPress plugin versions before 6.35 are affected by an unauthenticated stored content injection vulnerability via the updated_by parameter. The plugin does not restrict who can set the identifier that records which user last edited a form entry, and it relies on that identifier...

CVE-2026-85349

CVE-2026-85349 affects the FluentBoards WordPress plugin prior to version 2.0.15 . The root cause is an insecure direct object reference (IDOR) : the plugin fails to properly verify authorization when returning the list of boards a user belongs to. This allows any authenticated user at the Subscr...

CVE-2026-84088

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin (versions before 1.7.9 ) is vulnerable to a stored cross-site scripting (XSS) flaw in the Interactive Circle Widget . The plugin fails to validate or sanitize a widget link setting before embedding it in a JavaScript navigation call. A...

CVE-2026-85131

WPLP Cookie Consent (WordPress plugin, also known as WP Cookie Notice for GDPR, CCPA & ePrivacy Consent) versions before 4.4.4 are vulnerable to arbitrary post and page deletion via CSRF. The plugin fails to perform CSRF or capability checks when processing bulk actions on its administration scre...

CVE-2026-84907

Eventin (WP Event Solution) WordPress plugin versions 4.1.5 through 4.1.23 fail to properly authorise order finalisation when the offline (local) payment method is enabled. The flaw is a nonce exposed to unauthenticated visitors that is never validated against the caller's order ownership via the...

CVE-2026-84829

CVE-2026-84829 is an unauthenticated Stored XSS in the Optimole WordPress plugin (versions 4.2.3–4.2.11 ). The root cause is improper escaping of a user-supplied srcset descriptor value before it is used to build an image tag attribute, allowing an unauthenticated attacker to inject arbitrary HTM...

CVE-2026-84905

The Eventin WordPress plugin (also known as WP Event Solution) before 4.1.24 contains a privilege escalation vulnerability discovered by Karthik Ramakrishnan. When adding a speaker, the plugin fails to verify the acting user's capability to create accounts. This allows any user with contributor-l...

CVE-2026-78474

The Ni WooCommerce Sales Report WordPress plugin (versions before 4.2.0 ) lacks authentication and authorisation checks on a report-printing routine accessible via the btn_print parameter. This allows unauthenticated users to retrieve WooCommerce order details and customer contact information , t...

CVE-2026-78472

The Ni WooCommerce Sales Report WordPress plugin (versions before 4.2.0 ) contains an unauthenticated SQL injection vulnerability caused by a failure to sanitise and escape the sort parameter before use in a SQL statement. Discovered by Erwan LR (WPScan) via Patchstack, this allows remote attacke...

CVE-2026-82126

Schema & Structured Data for WP & AMP WordPress plugin versions 1.63–1.65 (before 1.66) contain an authorization flaw in the AI schema generation feature. The plugin does not verify that the requesting user is permitted to edit the specific post they request schema generation for, allowing any us...

CVE-2026-82124

The Schema & Structured Data for WP & AMP WordPress plugin versions prior to 1.66 fail to check whether a post is password-protected before including its content in the structured data it generates (specifically JSON-LD Schema Output ). This allows unauthenticated users to retrieve the content of...

CVE-2026-82125

CVE-2026-82125 affects the Schema & Structured Data for WP & AMP WordPress plugin, versions 1.46 through 1.65 . The plugin fails to verify comment ownership or moderation status before returning comment content, an IDOR (Insecure Direct Object Reference) flaw. This allows unauthenticated users to...

CVE-2026-76557

CVE-2026-76557 affects the WP Import Export Lite WordPress plugin in versions before 3.9.33 . Some import configuration values are not properly sanitised and escaped before being used in SQL statements, enabling an authenticated user whose role has been granted the plugin's import permission to p...

CVE-2026-76556

WP Import Export Lite WordPress plugin (versions before 3.9.33 ) is vulnerable to an authenticated SQL injection via improperly sanitised export filter values used in SQL statements. Any user holding the plugin's export permission—granted by default to administrators and potentially to lower role...