🚨 CVE-2026-88827
The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with the account's full privileges.
🎖@cveNotify
The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with the account's full privileges.
🎖@cveNotify
WPScan
Disable Users <= 1.0.5 - Disabled Account Authentication Bypass via XML-RPC and Application Passwords
See details on Disable Users <= 1.0.5 - Disabled Account Authentication Bypass via XML-RPC and Application Passwords CVE 2026-88827. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-88903
The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted content, allowing unauthenticated attackers to publish arbitrary posts containing malicious JavaScript on any site where its API key has never been configured.
🎖@cveNotify
The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted content, allowing unauthenticated attackers to publish arbitrary posts containing malicious JavaScript on any site where its API key has never been configured.
🎖@cveNotify
WPScan
Topcontent <= 1.2.1 - Unauthenticated Stored XSS via Content Webhook
See details on Topcontent <= 1.2.1 - Unauthenticated Stored XSS via Content Webhook CVE 2026-88903. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-88905
The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector WordPress plugin through 1.4's settings page or when a visitor loads a page displaying its output.
🎖@cveNotify
The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector WordPress plugin through 1.4's settings page or when a visitor loads a page displaying its output.
🎖@cveNotify
WPScan
KeyWord Collector <= 1.4 - Unauthenticated Stored XSS and Settings Update via WPKeyWordSettings
See details on KeyWord Collector <= 1.4 - Unauthenticated Stored XSS and Settings Update via WPKeyWordSettings CVE 2026-88905. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-88930
The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks.
🎖@cveNotify
The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks.
🎖@cveNotify
WPScan
Social Web Suite <= 4.1.12 - Unauthenticated Blind SQLi via Unset Shared Secret
See details on Social Web Suite <= 4.1.12 - Unauthenticated Blind SQLi via Unset Shared Secret CVE 2026-88930. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-89195
The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database.
🎖@cveNotify
The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database.
🎖@cveNotify
WPScan
Site Setup Wizard <= 1.5.8 - Unauthenticated SQLi via ssw_check_admin_email_exists
See details on Site Setup Wizard <= 1.5.8 - Unauthenticated SQLi via ssw_check_admin_email_exists CVE 2026-89195. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-89213
The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database.
🎖@cveNotify
The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database.
🎖@cveNotify
WPScan
Llavero.io <= 0.1.4 - Unauthenticated Blind SQLi via 'cill_login' Parameter
See details on Llavero.io <= 0.1.4 - Unauthenticated Blind SQLi via 'cill_login' Parameter CVE 2026-89213. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-89214
The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database.
🎖@cveNotify
The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database.
🎖@cveNotify
WPScan
WpCues Basic Quiz <= 1.6.5 - Unauthenticated SQLi via Quiz Result Submission
See details on WpCues Basic Quiz <= 1.6.5 - Unauthenticated SQLi via Quiz Result Submission CVE 2026-89214. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-89232
The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.
🎖@cveNotify
The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.
🎖@cveNotify
WPScan
RecordBrowser <= 1.1.7 - Unauthenticated SQLi via 'recordid' Parameter
See details on RecordBrowser <= 1.1.7 - Unauthenticated SQLi via 'recordid' Parameter CVE 2026-89232. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-89234
The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.
🎖@cveNotify
The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.
🎖@cveNotify
WPScan
WP-Partner <= 1.2.1 - Unauthenticated SQLi via 'id' Parameter
See details on WP-Partner <= 1.2.1 - Unauthenticated SQLi via 'id' Parameter CVE 2026-89234. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-89283
The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite the password of every published post, disclosing password-protected content or locking all posts behind an attacker-chosen password.
🎖@cveNotify
The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite the password of every published post, disclosing password-protected content or locking all posts behind an attacker-chosen password.
🎖@cveNotify
WPScan
WP Posts Password Batch Manager <= 1.1 - Unauthenticated Bulk Post Password Rewrite
See details on WP Posts Password Batch Manager <= 1.1 - Unauthenticated Bulk Post Password Rewrite CVE 2026-89283. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-89285
The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.
🎖@cveNotify
The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.
🎖@cveNotify
WPScan
Datalist it <= 0.0.3 - Unauthenticated SQLi via dli_fronted_action
See details on Datalist it <= 0.0.3 - Unauthenticated SQLi via dli_fronted_action CVE 2026-89285. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-89287
The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before using it in SQL statements, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.
🎖@cveNotify
The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before using it in SQL statements, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.
🎖@cveNotify
WPScan
ASPL Product Quotation <= 1.1.0 - Unauthenticated SQLi via 'quote_id' Parameter
See details on ASPL Product Quotation <= 1.1.0 - Unauthenticated SQLi via 'quote_id' Parameter CVE 2026-89287. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-89297
The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
🎖@cveNotify
The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
🎖@cveNotify
WPScan
Loja Automática <= 1.0.0 - Unauthenticated SQLi via 'id' Parameter
See details on Loja Automática <= 1.0.0 - Unauthenticated SQLi via 'id' Parameter CVE 2026-89297. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-89299
The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
🎖@cveNotify
The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
🎖@cveNotify
WPScan
WP Verify API <= 1.0.0 - Unauthenticated SQLi via 'verify' Parameter
See details on WP Verify API <= 1.0.0 - Unauthenticated SQLi via 'verify' Parameter CVE 2026-89299. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-89302
The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
🎖@cveNotify
The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
🎖@cveNotify
WPScan
Post Voting System <= 1.0 - Unauthenticated SQLi via 'id' Parameter
See details on Post Voting System <= 1.0 - Unauthenticated SQLi via 'id' Parameter CVE 2026-89302. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-89304
The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform blind SQL injection attacks.
🎖@cveNotify
The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform blind SQL injection attacks.
🎖@cveNotify
WPScan
Paymendo Bank Transfer <= 1.1 - Unauthenticated Blind SQLi via 'paymendo_bank_transfer_completed_payment' Parameter
See details on Paymendo Bank Transfer <= 1.1 - Unauthenticated Blind SQLi via 'paymendo_bank_transfer_completed_payment' Parameter CVE 2026-89304. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-89305
The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks.
🎖@cveNotify
The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks.
🎖@cveNotify
WPScan
Paymendo Bank Transfer <= 1.1 - Subscriber+ SQLi via 'orderBy' Parameter
See details on Paymendo Bank Transfer <= 1.1 - Subscriber+ SQLi via 'orderBy' Parameter CVE 2026-89305. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-91829
The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators.
🎖@cveNotify
The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators.
🎖@cveNotify
WPScan
Subscribe to Comments < 2.3.3 - Reflected XSS via 'ref' Parameter
See details on Subscribe to Comments < 2.3.3 - Reflected XSS via 'ref' Parameter CVE 2026-91829. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-93550
The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting it, allowing users with Subscriber-level access and above to make the Veeqo for WooCommerce WordPress plugin through 2.2.8 download and extract an attacker-controlled archive containing arbitrary PHP files into the WordPress root.
🎖@cveNotify
The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting it, allowing users with Subscriber-level access and above to make the Veeqo for WooCommerce WordPress plugin through 2.2.8 download and extract an attacker-controlled archive containing arbitrary PHP files into the WordPress root.
🎖@cveNotify
WPScan
Veeqo for WooCommerce <= 2.2.8 - Subscriber+ Arbitrary File Upload via start_veeqo_connection_process
See details on Veeqo for WooCommerce <= 2.2.8 - Subscriber+ Arbitrary File Upload via start_veeqo_connection_process CVE 2026-93550. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-96227
The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is opened (Stored XSS).
🎖@cveNotify
The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is opened (Stored XSS).
🎖@cveNotify
WPScan
Piotnet Forms <= 1.0.30 - Unauthenticated Stored XSS via File Upload
See details on Piotnet Forms <= 1.0.30 - Unauthenticated Stored XSS via File Upload CVE 2026-96227. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-97183
The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Subscriber, to retrieve the email addresses, display names and profile details of all registered users.
🎖@cveNotify
The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Subscriber, to retrieve the email addresses, display names and profile details of all registered users.
🎖@cveNotify
WPScan
WP-Invoice <= 4.3.1 - Subscriber+ User PII Disclosure via Unprotected AJAX Handlers
See details on WP-Invoice <= 4.3.1 - Subscriber+ User PII Disclosure via Unprotected AJAX Handlers CVE 2026-97183. View the latest Plugin Vulnerabilities on WPScan.
❤1