🚨 CVE-2026-104680
The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves for installing Envira Gallery WordPress plugin before 1.16.2 code before processing its setup-wizard Envira Gallery WordPress plugin before 1.16.2-installation request, and does not restrict the installation to its own curated list, allowing a Multisite subsite Administrator to install an arbitrary WordPress.org-published Envira Gallery WordPress plugin before 1.16.2 into the network-shared Envira Gallery WordPress plugin before 1.16.2 directory, a privilege Multisite reserves for the network Super Admin.
🎖@cveNotify
The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves for installing Envira Gallery WordPress plugin before 1.16.2 code before processing its setup-wizard Envira Gallery WordPress plugin before 1.16.2-installation request, and does not restrict the installation to its own curated list, allowing a Multisite subsite Administrator to install an arbitrary WordPress.org-published Envira Gallery WordPress plugin before 1.16.2 into the network-shared Envira Gallery WordPress plugin before 1.16.2 directory, a privilege Multisite reserves for the network Super Admin.
🎖@cveNotify
WPScan
Envira Gallery < 1.16.2 - Multisite Subsite Admin+ Arbitrary Plugin Installation via Onboarding Wizard
See details on Envira Gallery < 1.16.2 - Multisite Subsite Admin+ Arbitrary Plugin Installation via Onboarding Wizard CVE 2026-104680. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-104681
The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to view, allowing any user able to create and edit a gallery (Author and above by default) to disclose the title and excerpt of other users' private, draft, pending and trashed posts that WordPress would otherwise withhold from them.
🎖@cveNotify
The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to view, allowing any user able to create and edit a gallery (Author and above by default) to disclose the title and excerpt of other users' private, draft, pending and trashed posts that WordPress would otherwise withhold from them.
🎖@cveNotify
WPScan
Envira Gallery < 1.16.2 - Author+ Non-Public Post Title and Excerpt Disclosure via Gallery REST Field
See details on Envira Gallery < 1.16.2 - Author+ Non-Public Post Title and Excerpt Disclosure via Gallery REST Field CVE 2026-104681. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-104682
The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that the requester can edit an arbitrary post they name rather than that they are allowed to create the Envira Gallery WordPress plugin before 1.16.2's own gallery content, allowing users with contributor-level access to create and publish gallery posts that the Envira Gallery WordPress plugin before 1.16.2's settings otherwise withhold from them.
🎖@cveNotify
The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that the requester can edit an arbitrary post they name rather than that they are allowed to create the Envira Gallery WordPress plugin before 1.16.2's own gallery content, allowing users with contributor-level access to create and publish gallery posts that the Envira Gallery WordPress plugin before 1.16.2's settings otherwise withhold from them.
🎖@cveNotify
WPScan
Envira Gallery < 1.16.2 - Contributor Missing Authorization via Convert Gallery REST Route
See details on Envira Gallery < 1.16.2 - Contributor Missing Authorization via Convert Gallery REST Route CVE 2026-104682. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-104684
The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing authors to embed and expose other users' non-public gallery metadata to unauthenticated visitors.
🎖@cveNotify
The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing authors to embed and expose other users' non-public gallery metadata to unauthenticated visitors.
🎖@cveNotify
WPScan
Envira Gallery < 1.16.2 - Author+ IDOR via Shortcode
See details on Envira Gallery < 1.16.2 - Author+ IDOR via Shortcode CVE 2026-104684. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-106029
The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide.
🎖@cveNotify
The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide.
🎖@cveNotify
WPScan
WeddingCity Lite <= 1.0.4 - Unauthenticated Arbitrary Post and Attachment Deletion
See details on WeddingCity Lite <= 1.0.4 - Unauthenticated Arbitrary Post and Attachment Deletion CVE 2026-106029. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-107507
The Squadeno WordPress plugin before 1.12.0 does not enforce its restrictions on every way a sport can be saved, allowing users with the lowest-tier Trainer role to change the section, age group, author, password, comment settings and date of a sport they are assigned to.
🎖@cveNotify
The Squadeno WordPress plugin before 1.12.0 does not enforce its restrictions on every way a sport can be saved, allowing users with the lowest-tier Trainer role to change the section, age group, author, password, comment settings and date of a sport they are assigned to.
🎖@cveNotify
WPScan
Squadeno < 1.12.0 - Trainer+ Section and Age Group Reassignment via Quick Edit
See details on Squadeno < 1.12.0 - Trainer+ Section and Age Group Reassignment via Quick Edit CVE 2026-107507. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-107694
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that the vendor a commission calculation is requested for is the requesting vendor, allowing vendors to disclose the commission rate and fixed fee the marketplace administrator configured for other vendors.
🎖@cveNotify
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that the vendor a commission calculation is requested for is the requesting vendor, allowing vendors to disclose the commission rate and fixed fee the marketplace administrator configured for other vendors.
🎖@cveNotify
WPScan
Dokan < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure via Commission REST Endpoint
See details on Dokan < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure via Commission REST Endpoint CVE 2026-107694. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-108540
A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
🎖@cveNotify
A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
🎖@cveNotify
GitHub
CVE-2026-108540 · Issue #10 · SECWG/CVE
Command Injection Vulnerability in the File Distribution Feature of the Spug Open-Source Operations Platform 1. Product Overview Spug is a lightweight, agentless automation and operations platform ...
🚨 CVE-2026-108541
A vulnerability has been found in highwarden Super Store Finder up to 3.8. Affected is an unknown function of the file /products/superstorefinder/index.php. The manipulation of the argument lat/lng leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 3.9 is able to address this issue. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
🎖@cveNotify
A vulnerability has been found in highwarden Super Store Finder up to 3.8. Affected is an unknown function of the file /products/superstorefinder/index.php. The manipulation of the argument lat/lng leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 3.9 is able to address this issue. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
🎖@cveNotify
CodeCanyon
Super Store Finder
Super Store Finder – Easy to use Google Maps API Store Finder
Super Store Finder is a multi-language fully featured PHP/Javascript/MySQL store locator script integrated with the latest Google ...
Super Store Finder is a multi-language fully featured PHP/Javascript/MySQL store locator script integrated with the latest Google ...
🚨 CVE-2026-12980
The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the content is viewed.
🎖@cveNotify
The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the content is viewed.
🎖@cveNotify
WPScan
Post Snippets <= 4.2.4 - Contributor+ Stored XSS via Snippet Variable
See details on Post Snippets <= 4.2.4 - Contributor+ Stored XSS via Snippet Variable CVE 2026-12980. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-14854
The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request.
🎖@cveNotify
The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request.
🎖@cveNotify
WPScan
WooCommerce Bookings < 3.11.0 - Unauthenticated Denial of Service
See details on WooCommerce Bookings < 3.11.0 - Unauthenticated Denial of Service CVE 2026-14854. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-81153
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputting them in a gallery page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the gallery, including administrators, even where the unfiltered_html capability is disallowed such as on multisite.
🎖@cveNotify
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputting them in a gallery page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the gallery, including administrators, even where the unfiltered_html capability is disallowed such as on multisite.
🎖@cveNotify
WPScan
Robo Gallery < 5.2.6 - Author+ Stored XSS via Image Overlay Effect Meta
See details on Robo Gallery < 5.2.6 - Author+ Stored XSS via Image Overlay Effect Meta CVE 2026-81153. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-81154
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in one of its gallery layouts, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected gallery, including administrators.
🎖@cveNotify
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in one of its gallery layouts, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected gallery, including administrators.
🎖@cveNotify
WPScan
Robo Gallery < 5.2.6 - Author+ Stored XSS via Image Alt Text
See details on Robo Gallery < 5.2.6 - Author+ Stored XSS via Image Alt Text CVE 2026-81154. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-81155
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputting it on a frontend page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing a gallery, including administrators.
🎖@cveNotify
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputting it on a frontend page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing a gallery, including administrators.
🎖@cveNotify
WPScan
Robo Gallery < 5.2.6 - Author+ Stored XSS via Gallery Search Label
See details on Robo Gallery < 5.2.6 - Author+ Stored XSS via Gallery Search Label CVE 2026-81155. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-81156
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputting them on the gallery edit screen, allowing users with the Contributor role and above to store JavaScript that executes in the context of an administrator who opens the gallery for editing.
🎖@cveNotify
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputting them on the gallery edit screen, allowing users with the Contributor role and above to store JavaScript that executes in the context of an administrator who opens the gallery for editing.
🎖@cveNotify
WPScan
Robo Gallery < 5.2.6 - Contributor+ Stored XSS via Gallery Settings
See details on Robo Gallery < 5.2.6 - Contributor+ Stored XSS via Gallery Settings CVE 2026-81156. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-81420
The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks.
🎖@cveNotify
The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks.
🎖@cveNotify
WPScan
Tcard WP <= 1.8.0 - Unauthenticated SQLi via group_id Parameter
See details on Tcard WP <= 1.8.0 - Unauthenticated SQLi via group_id Parameter CVE 2026-81420. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-84251
The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
🎖@cveNotify
The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
🎖@cveNotify
WPScan
click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Arbitrary Options Update
See details on click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Arbitrary Options Update CVE 2026-84251. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-84252
The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
🎖@cveNotify
The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
🎖@cveNotify
WPScan
click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Arbitrary Options Update
See details on click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Arbitrary Options Update CVE 2026-84252. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-84253
The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
🎖@cveNotify
The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
🎖@cveNotify
WPScan
click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Arbitrary Options Update
See details on click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Arbitrary Options Update CVE 2026-84253. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-84254
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
🎖@cveNotify
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
🎖@cveNotify
WPScan
click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Arbitrary Options Update
See details on click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Arbitrary Options Update CVE 2026-84254. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-84258
The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
🎖@cveNotify
The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
🎖@cveNotify
WPScan
click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Stored XSS via post_notifications
See details on click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Stored XSS via post_notifications CVE 2026-84258. View the latest Plugin Vulnerabilities on WPScan.