CVE-2026-96902 N/A Easy Property Listings — The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to th…● PoC 2026-10-20 CVE-2026-96903 N/A Easy Property Listings — The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of …● PoC 2026-10-20 CVE-2026-103311 MEDIUM 5.3 Coinbase Commerce Payment Gateway For Woocommerce — The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authe…● PoC 2026-10-19 CVE-2026-106010 MEDIUM 5.3 Bdm Digital Payment Gateway — The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public …● PoC 2026-10-19 CVE-2026-106014 MEDIUM 5.3 Gateway For Vantiv On Wc — The Gateway for Vantiv on WC WordPress plugin through 1.0.1 does not verify the authenticity of the payment no…● PoC 2026-10-19 CVE-2026-106028 MEDIUM 5.3 Activetrail For Woocommerce — The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before…● PoC 2026-10-19 CVE-2026-106933 MEDIUM 6.8 Blaze Demo Importer — The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the …● PoC 2026-10-19 CVE-2026-110034 LOW 3.7 Salon Booking System — The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting …● PoC 2026-10-19 CVE-2026-74921 MEDIUM 6.8 Document Gallery — The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attr…● PoC 2026-10-19 CVE-2026-74922 MEDIUM 5.3 Document Gallery — The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticate…● PoC 2026-10-19 CVE-2026-86791 MEDIUM 5.3 Ipospays Payment Gateway For Woocommerce — The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a payment was …● PoC 2026-10-19 CVE-2026-89286 MEDIUM 5.3 Formflow For Gohighlevel (Ghl) — The FormFlow for GoHighLevel (GHL) WordPress plugin through 1.0.0 does not restrict access to a log file it w…● PoC 2026-10-19 CVE-2026-91046 MEDIUM 4.3 Elementsready Addons For Elementor — The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks th…● PoC 2026-10-19 CVE-2026-91047 MEDIUM 5.3 Elementsready Addons For Elementor — The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to pro…● PoC 2026-10-19 CVE-2026-91831 LOW 3.8 Subscribe To Comments — The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notificati…● PoC 2026-10-19 CVE-2026-94228 MEDIUM 5.3 Truebooker — The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handler…● PoC 2026-10-19 CVE-2026-94229 MEDIUM 5.3 Truebooker — The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before renderin…● PoC 2026-10-19 CVE-2026-94230 MEDIUM 5.3 Truebooker — The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, a…● PoC 2026-10-19 CVE-2026-94231 MEDIUM 5.3 Truebooker — The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functi…● PoC 2026-10-19 CVE-2026-94272 MEDIUM 5.3 Snap Finance — The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's…● PoC 2026-10-19 CVE-2026-94273 MEDIUM 5.3 Snap Finance — The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually…● PoC 2026-10-19 CVE-2026-94294 MEDIUM 5.3 App Builder — The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing …● PoC 2026-10-19 CVE-2026-109937 MEDIUM 5.4 Otter Blocks — The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to t…● PoC 2026-10-18 CVE-2026-110026 MEDIUM 4.9 Tasty Recipes Lite — The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities when creatin…● PoC 2026-10-18 CVE-2026-110031 HIGH 7.2 Salon Booking System — The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon sta…● PoC 2026-10-18 CVE-2026-110032 MEDIUM 5.5 Salon Booking System — The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staf…● PoC 2026-10-18 CVE-2026-110033 MEDIUM 6.8 Salon Booking System — The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before …● PoC 2026-10-18 CVE-2026-110035 MEDIUM 4.3 Salon Booking System — The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to …● PoC 2026-10-18 CVE-2026-110069 MEDIUM 4.3 Modern Events Calendar Lite — The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownershi…● PoC 2026-10-18 CVE-2026-110070 MEDIUM 6.5 Modern Events Calendar Lite — The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to ed…● PoC 2026-10-18 CVE-2026-110976 MEDIUM 4.9 Ai Engine — The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions b…● PoC 2026-10-18 CVE-2026-110981 HIGH 7.1 Wp Photo Album Plus — The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation valu…● PoC 2026-10-18 CVE-2026-111041 MEDIUM 4.9 Ai Engine — The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media managem…● PoC 2026-10-18 CVE-2026-87844 MEDIUM 5.3 Pickplugins Product Designer For Woocommerce — The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capabili…● PoC 2026-10-18 CVE-2026-96534 HIGH 7.7 Modern Events Calendar Lite — The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin bef…● PoC 2026-10-18 CVE-2026-103376 MEDIUM 5.3 Peachpay — Payments & Express Checkout For Woocommerce (Supports Stripe, Paypal, Square, Authorize.Net, Nmi) — The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NM…● PoC 2026-10-17 CVE-2026-104122 MEDIUM 6.8 Ukr To Lat — The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQ…● PoC 2026-10-17 CVE-2026-104246 MEDIUM 5.9 Contact Form 7 Signature Addon — The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value be…● PoC 2026-10-17 CVE-2026-106470 MEDIUM 5 Wp Data Access — The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its a…● PoC 2026-10-17 CVE-2026-110527 MEDIUM 5.3 Wp User Manager — The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during…● PoC 2026-10-17 CVE-2026-81343 MEDIUM 5.3 Acf Frontend Admin By Dynamiapps — The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on o…● PoC 2026-10-17 CVE-2026-81344 MEDIUM 6.6 Acf Frontend Admin By Dynamiapps — The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may …● PoC 2026-10-17 CVE-2026-91074 MEDIUM 6.8 Bsk Pdf Manager — The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before us…● PoC 2026-10-17 CVE-2026-92431 LOW 3.7 Patreon Wordpress — The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionalit…● PoC 2026-10-17 CVE-2026-92432 MEDIUM 4.3 Patreon Wordpress — The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redir…● PoC 2026-10-17 CVE-2026-92433 MEDIUM 6.5 Patreon Wordpress — The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon accou…● PoC 2026-10-17 CVE-2026-97314 MEDIUM 6.5 Thirstyaffiliates — The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requeste…● PoC 2026-10-17 CVE-2026-103696 MEDIUM 6.8 Mobile Builder — The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in …● PoC 2026-10-16 CVE-2026-105973 MEDIUM 4.3 Visual Form Builder — The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reord…● PoC 2026-10-16 CVE-2026-105974 MEDIUM 4.3 Visual Form Builder — The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying…● PoC 2026-10-16 CVE-2026-109930 MEDIUM 5.3 Maio — The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a cr…● PoC 2026-10-16 CVE-2026-109982 MEDIUM 4.2 Mb Custom Post Types & Custom Taxonomies — The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does not perform a capability chec…● PoC 2026-10-16 CVE-2026-110012 MEDIUM 4.3 Salon Booking System — The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API ro…● PoC 2026-10-16 CVE-2026-110013 MEDIUM 4.8 Salon Booking System — The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from…● PoC 2026-10-16 CVE-2026-110014 MEDIUM 5.3 Salon Booking System — The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creatin…● PoC 2026-10-16 CVE-2026-110015 HIGH 8.8 Salon Booking System — The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST A…● PoC 2026-10-16 CVE-2026-110029 MEDIUM 5.4 Squeeze — The Squeeze WordPress plugin before 1.8.1 does not perform a capability check on one of its AJAX actions, allo…● PoC 2026-10-16 CVE-2026-110039 LOW 2.7 Smush — The Smush WordPress plugin before 4.3.4 does not restrict changes to a network-wide access setting to network…● PoC 2026-10-16 CVE-2026-110135 HIGH 7.4 Otp Login & Register Woocommerce — The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password…● PoC 2026-10-16 CVE-2026-110179 MEDIUM 6.8 Affiliate Toolkit — The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an a…● PoC 2026-10-16 CVE-2026-110191 LOW 2.7 Product Delivery Date For Woocommerce — The Product Delivery Date for WooCommerce WordPress plugin before 3.3.2 does not perform a capability check b…● PoC 2026-10-16 CVE-2026-74923 MEDIUM 5.3 Document Gallery — The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when ge…● PoC 2026-10-16 CVE-2026-91830 MEDIUM 6.5 Subscribe To Comments — The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identi…● PoC 2026-10-16 CVE-2026-91833 MEDIUM 6.8 Wx Subscribe 微信支付付费订阅 — The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter before usin…● PoC 2026-10-16 CVE-2026-92427 MEDIUM 5.3 Coinsnap Bitcoin Crowdfunding — The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used t…● PoC 2026-10-16 CVE-2026-103304 MEDIUM 5.3 Easync Booking — The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several o…● PoC 2026-10-15 CVE-2026-103324 MEDIUM 5.3 Cardinity Payment Gateway For Woocommerce — The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authe…● PoC 2026-10-15 CVE-2026-104643 MEDIUM 4.2 Easy Https Redirection (Ssl) — The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in some of i…● PoC 2026-10-15 CVE-2026-106031 MEDIUM 6.5 Spin Wheel — The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate s…● PoC 2026-10-15 CVE-2026-109145 CRITICAL 9.8 User Rights Access Manager — The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX acco…● PoC 2026-10-15 CVE-2026-74920 HIGH 7.1 Document Gallery — The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before re…● PoC 2026-10-15 CVE-2026-92428 MEDIUM 5.3 Rede Itaú For Woocommerce — The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gate…● PoC 2026-10-15 CVE-2026-92429 MEDIUM 5.3 Rede Itaú For Woocommerce — The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gate…● PoC 2026-10-15 CVE-2026-96537 HIGH 7.5 Tutor Lms — The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates…● PoC 2026-10-15 CVE-2026-101301 MEDIUM 5.3 Wpcode — The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login s…● PoC 2026-10-14 CVE-2026-103307 HIGH 8.6 Walletdoc Payment Gateway For Woocommerce — The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and esc…● PoC 2026-10-14 CVE-2026-103308 MEDIUM 6.5 Visma Pay For Woocommerce — The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gatewa…● PoC 2026-10-14 CVE-2026-104644 MEDIUM 6.8 Image Photo Gallery Final Tiles Grid — The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape gallery co…● PoC 2026-10-14 CVE-2026-104751 MEDIUM 5.3 Rank Math Seo — The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability or nonce check before clearin…● PoC 2026-10-14 CVE-2026-105261 MEDIUM 6.8 Schedule Post Changes With Publishpress Future: Unpublish, Delete, Change Status, Trash, Change Categories — The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories…● PoC 2026-10-14 CVE-2026-105969 MEDIUM 5.3 Codeatoz B2b Suite For Woocommerce — The CodeAtoZ B2B Suite for WooCommerce WordPress plugin before 1.6.1 does not properly restrict access to gues…● PoC 2026-10-14 CVE-2026-105975 MEDIUM 5.3 Campay Shortcode Payment Gateway — The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Mo…● PoC 2026-10-14 CVE-2026-106098 MEDIUM 5.3 Wp Data Access — The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its applic…● PoC 2026-10-14 CVE-2026-106099 MEDIUM 5.3 Wp Data Access — The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to autho…● PoC 2026-10-14 CVE-2026-106166 MEDIUM 5.3 Nex Forms — The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validati…● PoC 2026-10-14 CVE-2026-106469 MEDIUM 6.8 Gutenverse Form — The Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon markup stored in its form block…● PoC 2026-10-14 CVE-2026-106646 MEDIUM 5.9 Classified Listing — The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the …● PoC 2026-10-14 CVE-2026-107126 HIGH 8.8 Wp Booking System — The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable requ…● PoC 2026-10-14 CVE-2026-107158 MEDIUM 5.3 Ltl Freight Quotes — The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation …● PoC 2026-10-14 CVE-2026-107160 MEDIUM 5.3 Ltl Freight Quotes — The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanit…● PoC 2026-10-14 CVE-2026-107178 MEDIUM 6.8 Image Photo Gallery Final Tiles Grid — The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox confi…● PoC 2026-10-14 CVE-2026-107319 MEDIUM 4.3 Gamipress — The GamiPress WordPress plugin before 8.0.6 does not perform a capability check or ownership verification on …● PoC 2026-10-14 CVE-2026-107320 MEDIUM 5.3 Gamipress — The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entrie…● PoC 2026-10-14 CVE-2026-107508 HIGH 8.6 Ultimate Multisite — The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select …● PoC 2026-10-14 CVE-2026-107594 CRITICAL 10 File Upload To Order — The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from att…● PoC 2026-10-14 CVE-2026-108064 MEDIUM 6.5 Wp Encryption — The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the …● PoC 2026-10-14 CVE-2026-108066 LOW 2.7 Wp 2fa — The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a …● PoC 2026-10-14 CVE-2026-108069 MEDIUM 5.3 Sunshine Photo Cart — The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access…● PoC 2026-10-14 CVE-2026-82844 MEDIUM 5.3 Wpforms Lite — The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed befo…● PoC 2026-10-14 CVE-2026-85000 MEDIUM 5.3 Embedpress — The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthentic…● PoC 2026-10-14 CVE-2026-85345 MEDIUM 4.1 Fv Flowplayer Video Player — The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied …● PoC 2026-10-14 CVE-2026-86787 HIGH 7.2 Affiliate Toolkit — The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a t…● PoC 2026-10-14 CVE-2026-86797 MEDIUM 6.8 Pricing Table — The Pricing Table WordPress plugin before 2.1.5 does not validate the scheme of a user-supplied link value in…● PoC 2026-10-14 CVE-2026-86799 HIGH 8.8 Forms — The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them be…● PoC 2026-10-14 CVE-2026-87843 MEDIUM 6.5 Trust Payments Gateway For Woocommerce — The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of t…● PoC 2026-10-14 CVE-2026-87968 MEDIUM 5.3 Product Feed For Google Shopping, Microsoft Advertising And 40+ Channels For Woocommerce Merchant — The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPres…● PoC 2026-10-14 CVE-2026-87974 MEDIUM 5.3 Asaas Gateway For Woocommerce — The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its payment web…● PoC 2026-10-14 CVE-2026-88927 MEDIUM 4.3 Rtmedia For Wordpress, Buddypress And Bbpress — The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user o…● PoC 2026-10-14 CVE-2026-88998 MEDIUM 5.3 Tickera — The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifi…● PoC 2026-10-14 CVE-2026-89288 HIGH 8.6 Fast Courier — The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL …● PoC 2026-10-14 CVE-2026-90989 MEDIUM 4.3 Tainacan — The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a manage…● PoC 2026-10-14 CVE-2026-91076 MEDIUM 5.3 Robokassa Payment Gateway For Woocommerce — The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity o…● PoC 2026-10-14 CVE-2026-92409 MEDIUM 6.8 Donation Thermometer — The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode a…● PoC 2026-10-14 CVE-2026-92426 MEDIUM 4.9 Yith Woocommerce Popup — The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user…● PoC 2026-10-14 CVE-2026-94254 MEDIUM 5.3 Sellkit — The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when totals are r…● PoC 2026-10-14 CVE-2026-94260 MEDIUM 5.3 Sifalo Pay — The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order be…● PoC 2026-10-14 CVE-2026-94261 MEDIUM 5.3 Sifalo Pay — The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to…● PoC 2026-10-14 CVE-2026-94360 MEDIUM 5.3 Paymentfor Gateway For Woocommerce — The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an in…● PoC 2026-10-14 CVE-2026-96900 MEDIUM 5.3 Cart Abandonment Recovery For Woocommerce — The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the …● PoC 2026-10-14 CVE-2026-96904 MEDIUM 5.3 Awp Classifieds — The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listi…● PoC 2026-10-14 CVE-2026-97315 MEDIUM 5.4 Responsive Blocks — The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted w…● PoC 2026-10-14 CVE-2026-89269 MEDIUM 6.8 Wp Testimonials — The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses …● PoC 2026-10-13 CVE-2026-89271 MEDIUM 5.3 Wp Businessdirectory — The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files sa…● PoC 2026-10-13 CVE-2026-107791 MEDIUM 6.5 Wp Comment Cleaner — The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on…● PoC 2026-10-12 CVE-2026-84166 MEDIUM 4.3 Hotel Booking — The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative bookin…● PoC 2026-10-12 CVE-2026-84167 MEDIUM 4.3 Hotel Booking — The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user reque…● PoC 2026-10-12 CVE-2025-15703 LOW 3.5 Hirezoot — The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings…● PoC 2026-10-12 CVE-2026-103305 HIGH 8.8 Prenotazioni — The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its se…● PoC 2026-10-11 CVE-2026-103694 HIGH 8.8 Mobile Builder — The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in …● PoC 2026-10-11 CVE-2026-103695 HIGH 8.6 Mobile Builder — The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in …● PoC 2026-10-11 CVE-2026-104028 CRITICAL 9.8 Anton Extensions — The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification,…● PoC 2026-10-11 CVE-2026-104680 HIGH 7.2 Envira Gallery — The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress …● PoC 2026-10-11 CVE-2026-104681 LOW 2.7 Envira Gallery — The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery…● PoC 2026-10-11 CVE-2026-104682 LOW 2.7 Envira Gallery — The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conve…● PoC 2026-10-11 CVE-2026-104684 LOW 2.7 Envira Gallery — The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery…● PoC 2026-10-11 CVE-2026-106029 HIGH 7.5 Weddingcity Lite — The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks bef…● PoC 2026-10-11 CVE-2026-107507 LOW 2.7 Squadeno — The Squadeno WordPress plugin before 1.12.0 does not enforce its restrictions on every way a sport can be sav…● PoC 2026-10-11 CVE-2026-107694 LOW 2.7 Dokan: Ai Powered Woocommerce Multivendor Marketplace Solution — The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not ver…● PoC 2026-10-11 CVE-2026-12980 MEDIUM 6.8 Post Snippets — The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into sn…● PoC 2026-10-11 CVE-2026-14854 HIGH 7.5 Woocommerce Bookings — The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it t…● PoC 2026-10-11 CVE-2026-81153 MEDIUM 6.8 Robo Gallery — The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before…● PoC 2026-10-11 CVE-2026-81154 MEDIUM 6.8 Robo Gallery — The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting …● PoC 2026-10-11 CVE-2026-81155 MEDIUM 6.8 Robo Gallery — The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputti…● PoC 2026-10-11 CVE-2026-81156 MEDIUM 6.8 Robo Gallery — The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings befo…● PoC 2026-10-11 CVE-2026-81420 HIGH 8.6 Tcard Wp — The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL …● PoC 2026-10-11 CVE-2026-81649 CRITICAL 9.1 Fundiin Cho Woocommerce — The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of it…● PoC 2026-10-11 CVE-2026-84251 CRITICAL 9.8 Click5 Crm Add On To Ninja Forms — The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF check…● PoC 2026-10-11 CVE-2026-84252 CRITICAL 9.8 Click5 Crm Add On To Wpforms — The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks wh…● PoC 2026-10-11 CVE-2026-84253 CRITICAL 9.8 Click5 Crm Add On To Gravity Forms — The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF che…● PoC 2026-10-11 CVE-2026-84254 CRITICAL 9.8 Click5 Crm Add On To Contact Form 7 — The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF ch…● PoC 2026-10-11 CVE-2026-84258 HIGH 8.8 Click5 Crm Add On To Ninja Forms — The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submi…● PoC 2026-10-11 CVE-2026-84259 HIGH 8.8 Click5 Crm Add On To Wpforms — The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted…● PoC 2026-10-11 CVE-2026-84260 HIGH 8.8 Click5 Crm Add On To Gravity Forms — The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content sub…● PoC 2026-10-11 CVE-2026-84261 HIGH 8.8 Click5 Crm Add On To Contact Form 7 — The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content su…● PoC 2026-10-11 CVE-2026-84734 CRITICAL 9.8 Mindstien Quick Login — The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the req…● PoC 2026-10-11 CVE-2026-84737 CRITICAL 9.8 Freeton Wp — The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticat…● PoC 2026-10-11 CVE-2026-85118 CRITICAL 9.8 Ai Content Generator Marketing — The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check…● PoC 2026-10-11 CVE-2026-85121 CRITICAL 9.1 Insurify — The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX act…● PoC 2026-10-11 CVE-2026-85126 HIGH 7.2 Crowdfundly — The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, al…● PoC 2026-10-11 CVE-2026-86706 CRITICAL 9.1 Quick Quotes — The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its …● PoC 2026-10-11 CVE-2026-86717 CRITICAL 9.1 Insurify — The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX act…● PoC 2026-10-11 CVE-2026-86798 HIGH 8.8 Hootboard — The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST end…● PoC 2026-10-11 CVE-2026-87760 HIGH 8.8 Web Vitals Tracking — The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements su…● PoC 2026-10-11 CVE-2026-87761 HIGH 8 Adwised Web Push Notification — The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce chec…● PoC 2026-10-11 CVE-2026-87762 HIGH 8.8 Adwised Web Push Notification — The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several…● PoC 2026-10-11 CVE-2026-87764 HIGH 8.8 Buddypress Instant Chat — The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belo…● PoC 2026-10-11 CVE-2026-88785 MEDIUM 4.7 Simple Membership — The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's pl…● PoC 2026-10-11 CVE-2026-88826 HIGH 8.8 Smugmug Embed — The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action t…● PoC 2026-10-11 CVE-2026-88827 HIGH 8.8 Disable Users — The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authent…● PoC 2026-10-11 CVE-2026-88903 HIGH 8.8 Topcontent — The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disa…● PoC 2026-10-11 CVE-2026-88905 HIGH 8.8 Keyword Collector — The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving …● PoC 2026-10-11 CVE-2026-88930 HIGH 8.6 Social Web Suite — The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before acce…● PoC 2026-10-11 CVE-2026-89195 HIGH 8.6 Site Setup Wizard — The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before …● PoC 2026-10-11 CVE-2026-89213 HIGH 8.6 Llavero.Io — The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using i…● PoC 2026-10-11 CVE-2026-89214 HIGH 8.6 Wpcues Basic Quiz — The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using…● PoC 2026-10-11 CVE-2026-89232 HIGH 8.6 Recordbrowser — The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a…● PoC 2026-10-11 CVE-2026-89234 HIGH 8.6 Wp Partner — The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQ…● PoC 2026-10-11 CVE-2026-89283 HIGH 8.6 Wp Posts Password Batch Manager — The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce chec…● PoC 2026-10-11 CVE-2026-89285 HIGH 8.6 Datalist It — The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before …● PoC 2026-10-11 CVE-2026-89287 HIGH 8.6 Aspl Product Quotation — The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before usin…● PoC 2026-10-11 CVE-2026-89297 HIGH 8.6 Loja AutomáTica — The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before us…● PoC 2026-10-11 CVE-2026-89299 HIGH 8.6 Wp Verify Api — The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before usin…● PoC 2026-10-11 CVE-2026-89302 HIGH 8.6 Post Voting System — The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before u…● PoC 2026-10-11 CVE-2026-89304 MEDIUM 6.5 Paymendo — The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it i…● PoC 2026-10-11 CVE-2026-89305 MEDIUM 6.5 Paymendo — The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it i…● PoC 2026-10-11 CVE-2026-91829 HIGH 7.1 Subscribe To Comments — The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecti…● PoC 2026-10-11 CVE-2026-93550 MEDIUM 4.3 Veeqo For Woocommerce — The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-i…● PoC 2026-10-11 CVE-2026-94235 MEDIUM 4.3 Memberhero — The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX…● PoC 2026-10-11 CVE-2026-96227 HIGH 8.8 Piotnet Forms — The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upl…● PoC 2026-10-11 CVE-2026-97183 MEDIUM 4.3 Wp Invoice — The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handl…● PoC 2026-10-11 CVE-2026-104752 HIGH 7.2 Rank Math Seo — The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded thr…● PoC 2026-10-10 CVE-2026-104753 MEDIUM 4.1 Rank Math Seo — The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before us…● PoC 2026-10-10 CVE-2026-104754 LOW 3.5 Rank Math Seo — The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before ou…● PoC 2026-10-10 CVE-2026-105976 MEDIUM 4.7 Portfolio Filter Gallery — The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a …● PoC 2026-10-10 CVE-2026-105977 LOW 2.2 Portfolio Filter Gallery — The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check …● PoC 2026-10-10 CVE-2026-105989 MEDIUM 5.3 Accept Paypal Payments Using Contact Form 7 — The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorizati…● PoC 2026-10-10 CVE-2026-105990 MEDIUM 5.3 Accept Paypal Payments Using Contact Form 7 — The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorizati…● PoC 2026-10-10 CVE-2026-105995 MEDIUM 5.3 Booking Package — The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stor…● PoC 2026-10-10 CVE-2026-107120 MEDIUM 5.3 Contest Gallery — The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-en…● PoC 2026-10-10 CVE-2026-107321 MEDIUM 5.4 W3 Total Cache — The W3 Total Cache WordPress plugin before 2.10.6 does not confine a media-import file copy to the document ro…● PoC 2026-10-10 CVE-2026-107323 MEDIUM 6.8 Gallery Photoblocks — The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings…● PoC 2026-10-10 CVE-2026-85571 MEDIUM 6.5 Tutor Lms — The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content orderi…● PoC 2026-10-10 CVE-2026-87780 HIGH 8.8 Ltl Freight Quotes — The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through a…● PoC 2026-10-10 CVE-2026-87781 HIGH 8.6 Ltl Freight Quotes — The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using i…● PoC 2026-10-10 CVE-2026-94256 HIGH 8.1 Sms Alert — The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the v…● PoC 2026-10-10 CVE-2026-94257 HIGH 8.1 Sms Alert — The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the …● PoC 2026-10-10 CVE-2026-103329 MEDIUM 5.3 Super Payments — The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming paymen…● PoC 2026-10-09 CVE-2026-106095 LOW 3.3 Code Snippets — The Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippet-man…● PoC 2026-10-09 CVE-2026-106097 MEDIUM 6.8 Code Snippets — The Code Snippets WordPress plugin before 3.10.0 does not sanitise and escape a user-supplied parameter before…● PoC 2026-10-09 CVE-2026-84220 MEDIUM 4.8 Kirki — The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when …● PoC 2026-10-09 CVE-2026-84224 MEDIUM 4.1 Kirki — The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, al…● PoC 2026-10-09 CVE-2026-85348 MEDIUM 4.3 Gdpr Data Request Form — The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of i…● PoC 2026-10-09 CVE-2026-86850 MEDIUM 6.5 Sku Error Fixer For Woocommerce — The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce chec…● PoC 2026-10-09 CVE-2026-86851 MEDIUM 6.5 Livees Checkout — The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check b…● PoC 2026-10-09 CVE-2026-87841 MEDIUM 5.3 Unitechpay — The UnitechPay WordPress plugin through 1.0.6.3 does not verify the authenticity of the payment notifications…● PoC 2026-10-09 CVE-2026-87846 MEDIUM 5.3 Shipping For Nova Poshta — The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or owne…● PoC 2026-10-09 CVE-2026-88931 MEDIUM 5.3 Social Web Suite — The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written t…● PoC 2026-10-09 CVE-2026-89235 MEDIUM 6.8 Testimonials By Bestwebsoft — The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter before…● PoC 2026-10-09 CVE-2026-92989 MEDIUM 4.3 Sendpress Newsletters — The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several n…● PoC 2026-10-09 CVE-2026-92990 MEDIUM 5.3 Sendpress Newsletters — The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded toke…● PoC 2026-10-09 CVE-2026-93548 HIGH 8.8 Foosales — The FooSales WordPress plugin before 1.43.3 does not verify that an authenticated caller is entitled to act a…● PoC 2026-10-09 CVE-2025-15700 HIGH 8.8 Awp Classifieds — The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an upload…● PoC 2026-10-09 CVE-2026-103309 HIGH 7.5 Gptranslate — The GPTranslate WordPress plugin before 2.34.14 does not properly restrict who can store translations, and do…● PoC 2026-10-08 CVE-2026-103517 MEDIUM 5.3 Airwallex Online Payments Gateway — The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment …● PoC 2026-10-08 CVE-2026-103646 CRITICAL 9.8 Ultimate Multisite — The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out che…● PoC 2026-10-08 CVE-2026-103692 CRITICAL 9.8 Frontend Dashboard — The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on acti…● PoC 2026-10-08 CVE-2026-104645 LOW 2.7 Image Photo Gallery Final Tiles Grid — The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization…● PoC 2026-10-08 CVE-2026-104646 MEDIUM 6.8 Image Photo Gallery Final Tiles Grid — The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery conf…● PoC 2026-10-08 CVE-2026-104671 MEDIUM 5.3 Tutorstarter — The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of …● PoC 2026-10-08 CVE-2026-105190 MEDIUM 5.3 Easy Digital Downloads — The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting…● PoC 2026-10-08 CVE-2026-105193 MEDIUM 4.8 Booking Calendar — The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with suffici…● PoC 2026-10-08 CVE-2026-105194 MEDIUM 4.3 Easy Digital Downloads — The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the curren…● PoC 2026-10-08 CVE-2026-105195 LOW 2.7 Booking Calendar — The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privile…● PoC 2026-10-08 CVE-2026-105196 LOW 3.3 Appointment Booking Plugin — The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on sev…● PoC 2026-10-08 CVE-2026-105197 LOW 2.7 Appointment Booking Plugin — The Appointment Booking Plugin WordPress plugin before 5.6.5 does not verify that a backend staff user is aut…● PoC 2026-10-08 CVE-2026-105198 MEDIUM 5.3 Appointment Booking Plugin — The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order r…● PoC 2026-10-08 CVE-2026-105260 MEDIUM 4.3 Database Addon For Wpforms ( Wpforms Entries ) — The Database Addon For WPForms ( wpforms entries ) WordPress plugin before 1.1.1 does not verify the CSRF non…● PoC 2026-10-08 CVE-2026-86826 MEDIUM 5.9 Backwpup — The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it …● PoC 2026-10-08 CVE-2026-86827 MEDIUM 5.3 Backwpup — The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execut…● PoC 2026-10-08 CVE-2026-86828 MEDIUM 6.6 Backwpup — The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted…● PoC 2026-10-08 CVE-2026-93509 MEDIUM 6.5 Wallet System For Woocommerce — The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amoun…● PoC 2026-10-08 CVE-2026-94244 MEDIUM 4.3 Wallet System For Woocommerce — The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and re…● PoC 2026-10-08 CVE-2026-94245 MEDIUM 6.5 Wallet System For Woocommerce — The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wa…● PoC 2026-10-08 CVE-2026-94246 MEDIUM 6.3 Wallet System For Woocommerce — The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named…● PoC 2026-10-08 CVE-2026-94258 LOW 2.7 Sms Alert — The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage…● PoC 2026-10-08 CVE-2026-94275 MEDIUM 5.3 Track Orders For Woocommerce — The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before r…● PoC 2026-10-08 CVE-2026-103323 MEDIUM 5.9 Integration For Epos Now And Woocommerce — The Integration for Epos Now and WooCommerce WordPress plugin before 4.11.2 does not perform an authorization …● PoC 2026-10-07 CVE-2026-103378 MEDIUM 6.5 Geliver AkıLlı Kargo Pazaryeri — The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a …● PoC 2026-10-07 CVE-2026-103681 MEDIUM 4.3 Frontend Dashboard — The Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capability check in one of its AJAX ac…● PoC 2026-10-07 CVE-2026-104049 MEDIUM 4.3 Academy Lms — The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when retu…● PoC 2026-10-07 CVE-2026-104050 MEDIUM 4.3 Academy Lms — The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the …● PoC 2026-10-07 CVE-2026-104651 MEDIUM 4.3 Yaad Sarig Payment Gateway For Wc — The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the…● PoC 2026-10-07 CVE-2026-104652 MEDIUM 6.8 Envira Gallery — The Envira Gallery WordPress plugin before 1.16.1 does not sanitise and escape a gallery item identifier befo…● PoC 2026-10-07 CVE-2026-104653 MEDIUM 6.8 Envira Gallery — The Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape user-supplied gallery display c…● PoC 2026-10-07 CVE-2026-104667 MEDIUM 6.8 Animated Number Counters — The Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Edit…● PoC 2026-10-07 CVE-2026-104677 HIGH 7.2 Wp Coder — The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to admi…● PoC 2026-10-07 CVE-2026-104678 LOW 2.7 Cp Media Player — The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page ha…● PoC 2026-10-07 CVE-2026-104953 MEDIUM 6.8 Mpg — The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data befor…● PoC 2026-10-07 CVE-2026-105316 HIGH 7.1 Magee Shortcodes — The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJA…● PoC 2026-10-07 CVE-2026-105322 MEDIUM 5.3 Magee Shortcodes — The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthentic…● PoC 2026-10-07 CVE-2026-82211 HIGH 8.2 Nexi Xpay Build — The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of i…● PoC 2026-10-07 CVE-2026-82212 HIGH 7.5 Nexi Xpay Build — The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payme…● PoC 2026-10-07 CVE-2026-86816 MEDIUM 5.3 Wpcafe — The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowin…● PoC 2026-10-07 CVE-2026-86833 MEDIUM 5.4 Metform — The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inser…● PoC 2026-10-07 CVE-2026-87782 HIGH 8.8 Koinonia Link — The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before s…● PoC 2026-10-07 CVE-2026-87971 HIGH 7.1 If So Dynamic Content — The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-suppli…● PoC 2026-10-07 CVE-2026-96530 MEDIUM 6.5 Optimole — The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored im…● PoC 2026-10-07 CVE-2026-97188 HIGH 8.8 String Locator — The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the …● PoC 2026-10-07 CVE-2026-97331 MEDIUM 4.3 User Private Files — The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the do…● PoC 2026-10-07 CVE-2026-97354 MEDIUM 4.1 Powerpress Podcasting Plugin By Blubrry — The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination…● PoC 2026-10-07 CVE-2026-86786 MEDIUM 5.3 Slider Pro — The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of…● PoC 2026-10-06 CVE-2026-89289 MEDIUM 5.3 Fast Courier — The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes o…● PoC 2026-10-06 CVE-2026-94270 MEDIUM 5.3 Deema Payment Gateway — The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment …● PoC 2026-10-06 CVE-2026-94271 MEDIUM 5.3 Deema Payment Gateway — The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider…● PoC 2026-10-06 CVE-2026-94278 MEDIUM 5.5 File Media Renamer — The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to …● PoC 2026-10-06 CVE-2026-94299 MEDIUM 6.5 Elegro Crypto Payment — The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured bef…● PoC 2026-10-06 CVE-2026-13607 MEDIUM 5.9 File Uploads Addon For Woocommerce — The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publ…● PoC 2026-10-05 CVE-2026-78371 MEDIUM 5.9 File Uploads Addon For Woocommerce — The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requestin…● PoC 2026-10-05 CVE-2026-84169 MEDIUM 5.3 Upi Qr Code Payment Gateway — The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation req…● PoC 2026-10-05 CVE-2026-104118 MEDIUM 5.3 Razorpay For Woocommerce — The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks …● PoC 2026-10-04 CVE-2026-104119 LOW 3.5 Simple Shopping Cart — The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values befor…● PoC 2026-10-04 CVE-2026-17005 MEDIUM 6.8 Horizontal Scrolling Announcements — The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its an…● PoC 2026-10-04 CVE-2026-86817 MEDIUM 4.9 Five Star Business Profile And Schema — The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbac…● PoC 2026-10-04 CVE-2026-93549 HIGH 8.8 Cocart — The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoin…● PoC 2026-10-04 CVE-2026-97332 MEDIUM 5.3 User Private Files — The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on mu…● PoC 2026-10-04 CVE-2026-101159 HIGH 7.5 Wp Ultimate Review — The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted t…● PoC 2026-10-03 CVE-2026-101160 HIGH 7.5 Wp Ultimate Review — The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numer…● PoC 2026-10-03 CVE-2026-101161 HIGH 7.5 Wp Ultimate Review — The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing craft…● PoC 2026-10-03 CVE-2026-101162 MEDIUM 6.4 Wp Ultimate Review — The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings befo…● PoC 2026-10-03 CVE-2026-103293 MEDIUM 6.8 Mpg — The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a pro…● PoC 2026-10-03 CVE-2026-103514 HIGH 7.5 Wp 2fa — The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been …● PoC 2026-10-03 CVE-2026-80517 LOW 3.5 Wp Ultimate Csv Importer — The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained …● PoC 2026-10-03 CVE-2026-80518 LOW 3.7 Wp Ultimate Csv Importer — The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving th…● PoC 2026-10-03 CVE-2026-85015 MEDIUM 6.6 Unlimited Elements For Elementor — The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside upload…● PoC 2026-10-03 CVE-2026-85568 MEDIUM 6.8 Unlimited Elements For Elementor — The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value b…● PoC 2026-10-03 CVE-2026-86832 MEDIUM 5.3 Metform — The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing…● PoC 2026-10-03 CVE-2026-86834 LOW 3.7 Metform — The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the …● PoC 2026-10-03 CVE-2026-88782 MEDIUM 6.8 Kubio Ai Page Builder — The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied va…● PoC 2026-10-03 CVE-2026-88783 HIGH 8.8 Kubio Ai Page Builder — The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elemen…● PoC 2026-10-03 CVE-2026-89236 HIGH 8.6 Saveto Wishlist Lite — The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using t…● PoC 2026-10-03