CVE-2026-88926

The VikRentItems Flexible Rental Management System WordPress plugin (versions before 1.2.4 ) is affected by an unauthenticated SQL injection vulnerability. The root cause is that several parameters are not properly sanitised and escaped before being used in SQL statements, allowing any unauthenti...

CVE-2026-86814

The UsersWP WordPress plugin before 1.5.10 fails to verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account. This allows unauthenticated attackers to take over any user account—including administrators—by asserting a victim's ...

CVE-2026-85680

The Ultimate Member WordPress plugin before 2.13.1 is affected by a stored cross-site scripting (XSS) vulnerability. The plugin fails to escape user-supplied profile names before outputting them in the page title, and decodes HTML entities after its own sanitisation has already run. This allows u...

CVE-2026-85574

CVE-2026-85574 affects the Unbounce Landing Pages WordPress plugin in versions 1.1.1 through 1.1.4 . The plugin fails to perform an authorization check in the set_unbounce_domains function when updating the configuration its front-end proxy relies on. Any authenticated user with a low-privilege r...

CVE-2026-86591

The Botiga Pro WordPress plugin before 1.6.5 is missing authorization checks on its Templates Builder REST route , allowing unauthenticated users to update arbitrary WordPress options with arbitrary values. This can lead to privilege escalation and a full site takeover . The same route also permi...

CVE-2026-84750

The Ultra Addons for Contact Form 7 WordPress plugin (versions 3.2.4–3.5.50 ) allows unauthenticated users to upload arbitrary files through its Signature Field because the plugin does not validate file type or extension and stores uploads at a predictable public path with the attacker-chosen ext...

CVE-2026-76554

CVE-2026-76554 affects the WP Import Export Lite WordPress plugin in versions prior to 3.9.35 . The root cause is a missing authorization check: the plugin does not verify that the user running an import is actually permitted to create or modify user accounts and assign roles. This allows an auth...

CVE-2025-15698

CVE-2025-15698 affects the Business Name Generator WordPress plugin through version 1.3 . The vulnerability stems from a failure to sanitize and escape the button color setting , enabling stored Cross-Site Scripting (XSS) by high-privilege users (admin or higher). Notably, the attack works even w...

CVE-2026-19860

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin (versions 3.5.6.2 through 3.6.5.2 ) allows arbitrary file deletion on the server due to an insufficient blocklist of PHP functions permitted as custom field-validation callbacks. The blocklist omits a file-deletion function, enabli...

CVE-2026-76790

CVE-2026-76790 affects the Estatik Real Estate Plugin for WordPress prior to version 4.3.5 . The plugin fails to sanitise and escape several values decoded from the get_listings hash parameter before reflecting them in an unauthenticated AJAX response , enabling a Reflected Cross-Site Scripting (...

CVE-2026-16557

The Nimble Page Builder WordPress plugin through 3.3.8 has a missing authorization check in its AJAX handler sek_get_nimble_content_for_seo_plugins , which returns page-builder content without verifying the requesting user's permissions. This allows any authenticated user with the lowest role (Su...

CVE-2026-93741

A buffer overflow in the formWlWds function (file /boafrm/formWlWds) of the Totolink A3002MU (firmware Hh-B20211125.1046) allows a remote, unauthenticated attacker to overflow the buffer by manipulating the submit-url argument. The flaw is rated CVSS 10.0 (Critical) with high impact on confidenti...

CVE-2026-92707

CVE-2026-92707 is currently in a reserved state with no publicly available technical details. The only associated signal is a sighting reference. Monitor for updates as the responsible party publishes details.

CVE-2026-92807

The Save as PDF Plugin by PDFCrowd for WordPress (≤ 4.6.1) is vulnerable to arbitrary function invocation via the pdf_created_callback shortcode attribute. The eval_shortcode() function copies attacker-supplied attributes into an options array without sanitization or allowlist enforcement. When t...

CVE-2026-12042

The WP2Social Auto Publish plugin for WordPress (versions up to and including 2.4.12 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'pages' parameter in admin settings, caused by insufficient input sanitization and output escaping. An authenticated attacker with administrator-level ...

CVE-2026-92967

CVE-2026-92967 affects the Pochipp WordPress plugin in versions up to and including 1.20.2 . The vulnerability is a Reflected Cross-Site Scripting flaw in the keyword parameter. The root cause is insufficient output escaping: the code reads $_GET['keyword'], applies only sanitize_text_field() (wh...

CVE-2026-89274

WP Recipe Maker for WordPress (all versions ≤ 10.8.1) is vulnerable to unauthenticated arbitrary shortcode execution via recipe comment content. The root cause lies in WPRM_Metadata::sanitize_metadata(), which recursively calls do_shortcode() on every scalar metadata field — including reviewBody,...

CVE-2026-89093

The Better Messages WordPress plugin (versions up to and including 2.15.33 ) is vulnerable to Information Exposure by Spoofing . The is_ai_bot_user() function identifies privileged internal AI bot accounts by checking for the prefix 'ai-chat-bot-' against a guest record's stored IP address, which...

CVE-2026-89081

The Tutor LMS WordPress plugin (eLearning and online course solution) is affected by Reflected Cross-Site Scripting (XSS) via the 'search' parameter in all versions up to and including 4.0.8 . The root cause is insufficient input sanitization and output escaping . Unauthenticated attackers can in...

CVE-2026-88944

CVE-2026-88944 is an authorization bypass in the Tutor LMS WordPress plugin (all versions up to and including 4.0.8 ). The plugin fails to properly verify that a user is authorized to perform an action, allowing authenticated attackers with subscriber-level access or above to permanently delete a...