CVE-2026-90922

The Paid Membership Subscriptions WordPress plugin before 3.0.9 fails to verify that the amount and currency reported by the payment provider match the pending payment before completing it. The CVELIST and VULNRICHMENT records identify PayPal Standard as the specific payment provider involved. Th...

CVE-2026-88904

CVE-2026-88904 affects the PuppyFW WordPress plugin through version 0.4.4 . The root cause is an improper authorization flaw on a REST route: the plugin validates the caller against a capability value taken directly from the request rather than a fixed server-side value. This allows any authentic...

CVE-2026-91008

Event Booking Manager for WooCommerce (WpEvently) WordPress plugin versions before 5.3.8 (specifically 5.3.6–5.3.7) fail to perform an ownership or authorization check before rendering booking confirmation details. This allows unauthenticated attackers to retrieve registered attendees' personal i...

CVE-2026-87836

The Comments Import & Export WordPress plugin (versions 2.1.11–2.5.3 ) contains an insufficient permissions check in its comment export feature. The export is neither restricted to users with comment-moderation capabilities nor scoped to content owned by the requesting user, so any user with the ...

CVE-2026-88795

The wpShopGermany IT-RECHT KANZLEI WordPress plugin (versions 1.6–2.3 ) contains an unauthenticated remote code execution flaw in its API authentication token mechanism. The token is derived from requester-controlled data and is created as a side effect of the validation check itself, making it p...

CVE-2026-86824

The Newsletter WordPress plugin before 9.3.8 fails to generate its email tracking signing key with sufficient entropy and signs tracking links with an unkeyed hash . An unauthenticated attacker who recovers that key offline can forge tracking links, obtain any subscriber's session token , and bot...

CVE-2026-87786

CVE-2026-87786 is an unauthenticated Stored XSS vulnerability in the Dewa Kirim WordPress plugin (versions ≤ 1.0.0). Delivery coordinates submitted at checkout are not properly escaped before being rendered inside an inline script, allowing any unauthenticated user to inject JavaScript that execu...

CVE-2026-88792

The Dictionary WordPress plugin (through version 1.0) is vulnerable to an unauthenticated stored cross-site scripting (XSS) flaw. The root cause is the absence of authorisation, sanitisation, or escaping when adding or updating dictionary entries, allowing unauthenticated attackers to inject arbi...

CVE-2026-86788

HT Mega Addons for Elementor WordPress plugin versions 3.2.0–3.2.5 contain a stored XSS vulnerability in the section headline rendering of several widgets and blocks. The plugin fails to restrict the HTML tag name to a safe allowlist, allowing users with contributor-level access or higher to stor...

CVE-2026-86709

The Pressengine WordPress plugin (versions ≤ 1.0) contains an unauthenticated authentication bypass caused by its login handler issuing a session token even when authentication fails. An unauthenticated attacker can exploit this to log in as any user, including administrators , effectively gainin...

CVE-2026-86710

The Login with QR WordPress plugin through 1.0.0 suffers from an unauthenticated authentication bypass. The plugin fails to verify that the autologin_code parameter is one it actually issued, instead matching any stored user metadata value. This allows unauthenticated attackers to log in as any u...

CVE-2026-86707

The Private Feed Key WordPress plugin (versions ≤ 0.1 ) contains an unauthenticated authentication bypass discovered by Naoki Kawahigashi. The plugin fails to verify that a feedkey parameter value was issued by itself, instead matching any stored user metadata value. This allows an unauthenticate...

CVE-2025-15697

The Dictionary WordPress plugin through version 1.0 fails to escape user input before reflecting it in the responses of several directly accessible scripts, enabling unauthenticated attackers to perform Reflected Cross-Site Scripting (XSS) . The vulnerability was discovered by Hassan Khan Yusufza...

CVE-2026-86446

LearnPress is a WordPress plugin for course creation. Versions 4.4.3 through 4.4.6 fail to restrict the correctness flags returned by the check-answer REST endpoint , allowing unauthenticated attackers to retrieve the correct answer for every option of a quiz question, along with the instructor's...

CVE-2026-85128

The Choose User Role at Registration WordPress plugin (also referenced as the WooCommerce variant) before 1.3.3 fails to validate the role requested at registration against the roles an administrator chose to offer. This allows unauthenticated users to request any role—including administrator —wh...

CVE-2026-85130

The WPLP Cookie Consent WordPress plugin (WP Cookie Notice for GDPR, CCPA & ePrivacy Consent) prior to 4.4.4 contains an unauthenticated stored XSS vulnerability. The plugin fails to escape a value submitted through a public endpoint before outputting it in a JavaScript context on an administrati...

CVE-2026-87796

The Multi Uploader for Gravity Forms WordPress plugin is vulnerable to unauthenticated arbitrary file upload in all versions up to and including 1.1.9 . The flaw resides in the move_file function in GFMU_FileUploader.php, where insufficient file type validation during chunked upload handling allo...

CVE-2026-87935

The Paid Downloads WordPress plugin (versions ≤ 3.15) is vulnerable to an unauthenticated arbitrary file upload via the paiddownloads_update_file action. The root cause is missing authorization and file type validation in the admin_request_handler function, which is reachable without authenticati...

CVE-2026-25294

CVE-2026-25294 is a buffer over-read in Qualcomm WLAN Firmware that causes a transient denial of service while parsing a frame during channel usage. The adjacent-network attack vector (CVSS 3.1: 7.4 HIGH , AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) indicates an attacker on an adjacent network can trigg...

CVE-2026-25290

CVE-2026-25290 is an Integer Overflow or Wraparound vulnerability in Qualcomm OOBM (Out-of-Bounds Memory). The root cause lies in memory corruption when validating large data buffers from external sources, where an addition operation is used to check buffer length, allowing an integer overflow to...