🚨 CVE-2026-16988
The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public (pending or draft) listings.
🎖@cveNotify
The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public (pending or draft) listings.
🎖@cveNotify
WPScan
GeoDirectory < 2.8.169 - Unauthenticated Pending/Draft Listing Disclosure via markers REST Endpoint
See details on GeoDirectory < 2.8.169 - Unauthenticated Pending/Draft Listing Disclosure via markers REST Endpoint CVE 2026-16988. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-17017
The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action, and does not include a capability check on that action, allowing users with Subscriber-level access and above to perform SQL injection attacks.
🎖@cveNotify
The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action, and does not include a capability check on that action, allowing users with Subscriber-level access and above to perform SQL injection attacks.
🎖@cveNotify
WPScan
CubeWP Framework < 1.1.31 - Subscriber+ SQL Injection via cubewp_remove_relation
See details on CubeWP Framework < 1.1.31 - Subscriber+ SQL Injection via cubewp_remove_relation CVE 2026-17017. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-18032
The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guarding that action does not cover them, allowing unauthenticated attackers to read arbitrary columns of the database table the affected front-end form is bound to, including user password hashes where that table is the users table.
🎖@cveNotify
The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guarding that action does not cover them, allowing unauthenticated attackers to read arbitrary columns of the database table the affected front-end form is bound to, including user password hashes where that table is the users table.
🎖@cveNotify
WPScan
WP Data Access < 5.5.79 - Unauthenticated Sensitive Data Disclosure via Autocomplete Column Authorization Bypass
See details on WP Data Access < 5.5.79 - Unauthenticated Sensitive Data Disclosure via Autocomplete Column Authorization Bypass CVE 2026-18032. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-18464
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.
🎖@cveNotify
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.
🎖@cveNotify
WPScan
WP Maps Pro < 6.1.3 - Unauthenticated Denial of Service
See details on WP Maps Pro < 6.1.3 - Unauthenticated Denial of Service CVE 2026-18464. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-18465
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include and execute arbitrary existing local PHP files on the server.
🎖@cveNotify
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include and execute arbitrary existing local PHP files on the server.
🎖@cveNotify
WPScan
WP Maps Pro < 6.1.3 - Unauthenticated Local File Inclusion
See details on WP Maps Pro < 6.1.3 - Unauthenticated Local File Inclusion CVE 2026-18465. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-18473
The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
🎖@cveNotify
The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
🎖@cveNotify
WPScan
WP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' Parameter
See details on WP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' Parameter CVE 2026-18473. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-18603
The PiWeb Cancel order / Refund request for WooCommerce WordPress plugin before 1.3.4.34 does not have authorization or ownership checks when adding the contents of a previous order to the cart, allowing unauthenticated users to disclose the contents of other customers' orders, as well as to clear and repopulate a logged in user's cart via a crafted link.
🎖@cveNotify
The PiWeb Cancel order / Refund request for WooCommerce WordPress plugin before 1.3.4.34 does not have authorization or ownership checks when adding the contents of a previous order to the cart, allowing unauthenticated users to disclose the contents of other customers' orders, as well as to clear and repopulate a logged in user's cart via a crafted link.
🎖@cveNotify
WPScan
Cancel Order & Request Woocommerce < 1.3.4.34 - Unauthenticated Order Content Disclosure via Reorder AJAX Actions
See details on Cancel Order & Request Woocommerce < 1.3.4.34 - Unauthenticated Order Content Disclosure via Reorder AJAX Actions CVE 2026-18603. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-13701
The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the site, which could allow administrators (including those without the unfiltered_html capability, such as on multisite) to perform Stored Cross-Site Scripting attacks that execute in the context of any visitor viewing affected pages.
🎖@cveNotify
The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the site, which could allow administrators (including those without the unfiltered_html capability, such as on multisite) to perform Stored Cross-Site Scripting attacks that execute in the context of any visitor viewing affected pages.
🎖@cveNotify
WPScan
Advanced Excerpt < 4.5 - Admin+ Stored XSS via Ellipsis Setting
See details on Advanced Excerpt < 4.5 - Admin+ Stored XSS via Ellipsis Setting CVE 2026-13701. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-14206
The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data (name, email, phone, address) stored in form drafts.
🎖@cveNotify
The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data (name, email, phone, address) stored in form drafts.
🎖@cveNotify
WPScan
HT Contact Form < 2.9.3 - Unauthenticated Saved Form Draft Data Disclosure
See details on HT Contact Form < 2.9.3 - Unauthenticated Saved Form Draft Data Disclosure CVE 2026-14206. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-17010
The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level access and above to inject stored Cross-Site Scripting payloads that execute in the browser of a higher-privileged user who reviews the content.
🎖@cveNotify
The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level access and above to inject stored Cross-Site Scripting payloads that execute in the browser of a higher-privileged user who reviews the content.
🎖@cveNotify
WPScan
Saitama Addon Pack <= 1.0.8 - Contributor+ Stored XSS via Post Meta
See details on Saitama Addon Pack <= 1.0.8 - Contributor+ Stored XSS via Post Meta CVE 2026-17010. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-17019
The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting).
🎖@cveNotify
The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting).
🎖@cveNotify
WPScan
JetEngine < 3.8.13.1 - Unauthenticated Stored XSS via Form File Upload (SVG)
See details on JetEngine < 3.8.13.1 - Unauthenticated Stored XSS via Form File Upload (SVG) CVE 2026-17019. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-17022
The Salon Booking System WordPress plugin through 10.30.33 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplying a sequential booking identifier.
🎖@cveNotify
The Salon Booking System WordPress plugin through 10.30.33 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplying a sequential booking identifier.
🎖@cveNotify
WPScan
Salon Booking System – Free Version < 10.30.34 - Unauthenticated Booking Information Disclosure via Booking Wizard
See details on Salon Booking System – Free Version < 10.30.34 - Unauthenticated Booking Information Disclosure via Booking Wizard CVE 2026-17022. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-17541
The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them.
🎖@cveNotify
The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them.
🎖@cveNotify
WPScan
Bit File Manager < 6.9.1 - Unauthenticated File Activity Log Disclosure
See details on Bit File Manager < 6.9.1 - Unauthenticated File Activity Log Disclosure CVE 2026-17541. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-17542
The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including archives and documents which may contain sensitive data.
🎖@cveNotify
The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including archives and documents which may contain sensitive data.
🎖@cveNotify
WPScan
Bit File Manager < 6.9.1 - Subscriber+ Sensitive Data Disclosure via bitapps_fm_connector
See details on Bit File Manager < 6.9.1 - Subscriber+ Sensitive Data Disclosure via bitapps_fm_connector CVE 2026-17542. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-18470
The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to obtain registered users' email addresses, including administrators'.
🎖@cveNotify
The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to obtain registered users' email addresses, including administrators'.
🎖@cveNotify
WPScan
Login & Register Forms < 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password Response
See details on Login & Register Forms < 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password Response CVE 2026-18470. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-18946
The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by other users.
🎖@cveNotify
The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by other users.
🎖@cveNotify
WPScan
Contact Form to Any API < 3.0.7 - Unauthenticated Sensitive File Disclosure via Predictable Filename
See details on Contact Form to Any API < 3.0.7 - Unauthenticated Sensitive File Disclosure via Predictable Filename CVE 2026-18946. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-19053
The ProSolution WP Client WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticated visitors, leading to a blind SQL injection.
🎖@cveNotify
The ProSolution WP Client WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticated visitors, leading to a blind SQL injection.
🎖@cveNotify
WPScan
ProSolution WP Client < 2.0.6 - Unauthenticated Blind SQLi via 'jobID' Parameter
See details on ProSolution WP Client < 2.0.6 - Unauthenticated Blind SQLi via 'jobID' Parameter CVE 2026-19053. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-55814
Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0.
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
🎖@cveNotify
Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0.
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
🎖@cveNotify
🚨 CVE-2026-61899
Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs.
Users are recommended to upgrade to version 5.9.1, which fixes this issue.
🎖@cveNotify
Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs.
Users are recommended to upgrade to version 5.9.1, which fixes this issue.
🎖@cveNotify
🚨 CVE-2026-65942
TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8.0.
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
🎖@cveNotify
TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8.0.
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
🎖@cveNotify
🚨 CVE-2026-65945
Logs contain replayable JWT tokens in Apache Ranger versions <= 2.8.0
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
🎖@cveNotify
Logs contain replayable JWT tokens in Apache Ranger versions <= 2.8.0
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
🎖@cveNotify