🚨 CVE-2026-24527
Missing Authorization vulnerability in Patterns in the cloud Autoship Cloud for WooCommerce Subscription Products allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through 2.14.0.

🎖@cveNotify

🚨 CVE-2026-24554
Cross-Site Request Forgery (CSRF) vulnerability in Convers Lab WPSubscription allows Cross Site Request Forgery.

This issue affects WPSubscription: from n/a through 1.9.1.

🎖@cveNotify

🚨 CVE-2026-24582
Missing Authorization vulnerability in WPPOOL FlexTable allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects FlexTable: from n/a through 3.24.0.

🎖@cveNotify

🚨 CVE-2026-24586
Missing Authorization vulnerability in Themeansar Newses allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Newses: from n/a through 2.0.0.77.

🎖@cveNotify

🚨 CVE-2026-24592
Missing Authorization vulnerability in Lucian Apostol Auto Affiliate Links allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Auto Affiliate Links: from n/a through 6.8.8.3.

🎖@cveNotify

🚨 CVE-2026-27346
Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects B2BKing: from n/a before 5.2.10.

🎖@cveNotify

🚨 CVE-2026-27357
Missing Authorization vulnerability in Cornel Raiu WP Search Analytics allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects WP Search Analytics: from n/a before 1.5.0.

🎖@cveNotify

🚨 CVE-2026-24937
Improper Control of Generation of Code ('Code Injection') vulnerability in VideoWhisper.Com Broadcast Live Video allows Code Injection.

This issue affects Broadcast Live Video: from n/a before 7.1.3.

🎖@cveNotify

🚨 CVE-2026-32389
Missing Authorization vulnerability in Linethemes NanoCare allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects NanoCare: from n/a before 1.2.2.

🎖@cveNotify

🚨 CVE-2026-39436
Cross-Site Request Forgery (CSRF) vulnerability in bgermann CformsII allows Cross Site Request Forgery.

This issue affects CformsII: from n/a through 15.1.3.

🎖@cveNotify

🚨 CVE-2026-42773
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eMagicOne eMagicOne Store Manager allows Blind SQL Injection.

This issue affects eMagicOne Store Manager: from n/a through 1.3.2.

🎖@cveNotify

🚨 CVE-2026-42774
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine allows SQL Injection.

This issue affects JetEngine: from n/a through 3.8.8.1.

🎖@cveNotify

🚨 CVE-2026-42776
Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Sunshine Photo Cart: from n/a through 3.6.7.

🎖@cveNotify

🚨 CVE-2026-45209
Missing Authorization vulnerability in edward_plainview MyCryptoCheckout allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects MyCryptoCheckout: from n/a through 2.161.

🎖@cveNotify

🚨 CVE-2026-45217
Authentication Bypass Using an Alternate Path or Channel vulnerability in ThemeHigh Stripe Payment Gateway for WooCommerce allows Password Recovery Exploitation.

This issue affects Stripe Payment Gateway for WooCommerce: from n/a through 5.0.7.

🎖@cveNotify

🚨 CVE-2026-45435
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows DOM-Based XSS.

This issue affects WP Activity Log: from n/a through 5.6.3.

🎖@cveNotify

🚨 CVE-2026-45438
Missing Authorization vulnerability in WebToffee Smart Coupons for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Smart Coupons for WooCommerce: from n/a before 2.3.0.

🎖@cveNotify

🚨 CVE-2026-48837
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements For Elementor allows Blind SQL Injection.

This issue affects Unlimited Elements For Elementor: from n/a through 2.0.8.

🎖@cveNotify

🚨 CVE-2025-71310
The GDPR cookies module for Backdrop CMS (before

1.x-1.3.5) doesn't sufficiently protect visitors from Cross Site Scripting (XSS) if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with the permission "Create a GDPR Cookies Service" or "Edit any GDPR Cookies Service" and a site must have added a YouTube service as configuration.

🎖@cveNotify

🚨 CVE-2026-42496
Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.

_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.

A subsequent open through the extracted name reads or writes the attacker chosen path.

🎖@cveNotify

🚨 CVE-2026-58315
Cross-site request forgery vulnerability exists in SEIKO EPSON Web Config. If a user views a malicious page while logged into Web Config, unintended operations may be performed.

🎖@cveNotify