CVE-2026-90982

CVE-2026-90982 affects the @fastify/static plugin (versions before 10.1.4 ). On case-insensitive filesystems such as Windows or the default macOS volume, a mismatch between the case-sensitive route matcher and the case-insensitive filesystem allows an unauthenticated attacker to bypass route guar...

CVE-2026-44940

CVE-2026-44940 affects the rancher-extension-stackstate extension in SUSE Observability . The root cause is the exposure of service tokens in plain configuration or insecure locations , rather than storing them in a secure secret management mechanism. An attacker with minimal access (low privileg...

CVE-2026-91019

Event Booking Manager for WooCommerce (also identified as WpEvently ) before version 5.6.0 contains an improper access control flaw: the plugin's stored payment gateway configuration is not restricted by user role. As a result, any user with Contributor-level access or above can read the site's P...

CVE-2026-91014

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 fails to sanitise and escape certain parameters before reflecting them in the page, enabling an unauthenticated reflected XSS attack via the Location Selector Endpoint . An attacker must convince a victim to follow a ...

CVE-2026-91011

The EWWW Image Optimizer WordPress plugin (versions before 8.7.7 ) fails to properly escape image attribute values when rewriting page output, specifically through image class attribute backreference expansion . This allows authenticated users with author-level access or above to inject arbitrary...

CVE-2026-91010

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin (versions 2.0.5–5.1.0 ) contains a missing authorization flaw in its message deletion AJAX action. The plugin checks only that a nonce parameter is present without validating it and does not verify the reques...

CVE-2026-91015

Master Addons for Elementor WordPress plugin (versions 3.0.0–3.1.8 ) suffers from a missing authorization check on the AJAX action jltma_popup_disable_expired , which is used to deactivate Popup Builder popups. The only protection is a nonce publicly output to every visitor , meaning any unauthen...

CVE-2026-91016

The Motors WordPress plugin (a car dealership classified listings plugin) before version 1.4.121 contains an unauthorized disclosure vulnerability . The plugin fails to verify whether a request is authorized to view a user's non-published listings, allowing unauthenticated attackers to read any a...

CVE-2026-90923

CVE-2026-90923 affects the Autopay WordPress plugin in versions before 5.0.1 . The root cause is a missing signature enforcement on one of its payment callback endpoints, which allows unauthenticated users to disclose and delete the stored payment parameters of other customers' orders. The vulner...

CVE-2026-91009

The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before version 2.1.3 lacks authorization and CSRF checks in its AJAX actions, specifically the woot_update_attachment action. This allows any authenticated user at the subscriber level to change the title of arbitrary pos...

CVE-2026-90922

The Paid Membership Subscriptions WordPress plugin before 3.0.9 fails to verify that the amount and currency reported by the payment provider match the pending payment before completing it. The CVELIST and VULNRICHMENT records identify PayPal Standard as the specific payment provider involved. Th...

CVE-2026-88904

CVE-2026-88904 affects the PuppyFW WordPress plugin through version 0.4.4 . The root cause is an improper authorization flaw on a REST route: the plugin validates the caller against a capability value taken directly from the request rather than a fixed server-side value. This allows any authentic...

CVE-2026-91008

Event Booking Manager for WooCommerce (WpEvently) WordPress plugin versions before 5.3.8 (specifically 5.3.6–5.3.7) fail to perform an ownership or authorization check before rendering booking confirmation details. This allows unauthenticated attackers to retrieve registered attendees' personal i...

CVE-2026-88795

The wpShopGermany IT-RECHT KANZLEI WordPress plugin (versions 1.6–2.3 ) contains an unauthenticated remote code execution flaw in its API authentication token mechanism. The token is derived from requester-controlled data and is created as a side effect of the validation check itself, making it p...

CVE-2026-87836

The Comments Import & Export WordPress plugin (versions 2.1.11–2.5.3 ) contains an insufficient permissions check in its comment export feature. The export is neither restricted to users with comment-moderation capabilities nor scoped to content owned by the requesting user, so any user with the ...

CVE-2026-87786

CVE-2026-87786 is an unauthenticated Stored XSS vulnerability in the Dewa Kirim WordPress plugin (versions ≤ 1.0.0). Delivery coordinates submitted at checkout are not properly escaped before being rendered inside an inline script, allowing any unauthenticated user to inject JavaScript that execu...

CVE-2026-86824

The Newsletter WordPress plugin before 9.3.8 fails to generate its email tracking signing key with sufficient entropy and signs tracking links with an unkeyed hash . An unauthenticated attacker who recovers that key offline can forge tracking links, obtain any subscriber's session token , and bot...

CVE-2026-88792

The Dictionary WordPress plugin (through version 1.0) is vulnerable to an unauthenticated stored cross-site scripting (XSS) flaw. The root cause is the absence of authorisation, sanitisation, or escaping when adding or updating dictionary entries, allowing unauthenticated attackers to inject arbi...

CVE-2026-86788

HT Mega Addons for Elementor WordPress plugin versions 3.2.0–3.2.5 contain a stored XSS vulnerability in the section headline rendering of several widgets and blocks. The plugin fails to restrict the HTML tag name to a safe allowlist, allowing users with contributor-level access or higher to stor...

CVE-2026-86709

The Pressengine WordPress plugin (versions ≤ 1.0) contains an unauthenticated authentication bypass caused by its login handler issuing a session token even when authentication fails. An unauthenticated attacker can exploit this to log in as any user, including administrators , effectively gainin...