| 2026-10-17 |
WPSEC-2026-1181 |
WP Booking System | WP Booking System <= 2.1.0.3 - Authenticated (Subscriber+) Missing Authorization to Booking Data Exposure via Admin Calendar Refresh AJAX Action |
Medium 4.3 |
2.1.0.4 |
| 2026-10-17 |
WPSEC-2026-1180 |
Sermon Browser | Sermon Browser <= 0.45.22 - Unauthenticated Open Redirect via 'url' Parameter |
Medium 6.1 |
0.46.0 |
| 2026-10-17 |
WPSEC-2026-1179 |
Sermon Browser | Sermon Browser <= 0.45.22 - Unauthenticated Stored Cross-Site Scripting via Preacher, Series and Service Names |
High 7.2 |
0.46.0 |
| 2026-10-17 |
WPSEC-2026-1178 |
Sermon Browser | Sermon Browser <= 0.45.22 - Missing Authorization to Unauthenticated Preacher, Series, Service and File Modification |
High 7.3 |
0.46.0 |
| 2026-10-17 |
WPSEC-2026-1177 |
Sermon Browser | Sermon Browser <= 0.45.22 - Authenticated (Author+) Stored Cross-Site Scripting via Embed Code |
Medium 6.4 |
0.46.0 |
| 2026-10-17 |
WPSEC-2026-1176 |
Sermon Browser | Sermon Browser <= 0.45.22 - Authenticated (Author+) Server-Side Request Forgery via Remote File Import |
Medium 6.4 |
0.46.0 |
| 2026-10-17 |
WPSEC-2026-1175 |
Read More Without Refresh | Read More Without Refresh < 4.3.1 - Reflected Cross-Site Scripting via Pricing Page Query Parameters |
Medium 6.1 |
4.3.1 |
| 2026-10-17 |
WPSEC-2026-1174 |
Read More Without Refresh | Read More Without Refresh < 4.3.1 - Unauthenticated Content Injection via Freemius SDK 'purchase_completed' Admin Notice |
Low 3.7 |
4.3.1 |
| 2026-10-17 |
WPSEC-2026-1173 |
LearnPress | LearnPress <= 4.4.10 - Authenticated (Subscriber+) Missing Authorization to Restricted Course Enrollment via JWT Checkout REST Endpoint |
Medium 5.4 |
4.4.11 |
| 2026-10-17 |
WPSEC-2026-1172 |
LearnPress | LearnPress <= 4.4.10 - Unauthenticated Password Protection Bypass to Sensitive Information Exposure via REST API |
Medium 5.3 |
4.4.11 |
| 2026-10-17 |
WPSEC-2026-1171 |
LearnPress | LearnPress <= 4.4.10 - Authenticated (LP Instructor+) Missing Authorization to Arbitrary Course Duplication and Permanent Deletion via Course Builder |
Medium 6.3 |
4.4.11 |
| 2026-10-17 |
WPSEC-2026-1170 |
Better Search | Better Search <= 4.5.1 - Unauthenticated Sensitive Information Exposure via Password-Protected Post Thumbnails |
Low 3.7 |
4.5.2 |
| 2026-10-17 |
WPSEC-2026-1169 |
Contextual Related Posts | Contextual Related Posts <= 4.5.1 - Unauthenticated Sensitive Information Exposure via Related Post Thumbnails of Password-Protected Posts |
Medium 5.3 |
4.5.2 |
| 2026-10-17 |
WPSEC-2026-1168 |
Mang Board | Mang Board <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via mb_image Shortcode |
Medium 6.4 |
2.4.6 |
| 2026-10-17 |
WPSEC-2026-1167 |
ECS | ECS <= 4.3.12 - Authenticated (Contributor+) Insecure Direct Object Reference to Dynamic Repeater Binding Modification |
Medium 4.3 |
4.3.13 |
| 2026-10-17 |
WPSEC-2026-1166 |
Appointment Booking Plugin | Appointment Booking Plugin <= 5.7.4 - Unauthenticated OTP Brute Force via Race Condition in OTP Verification |
Medium 4.8 |
5.7.5 |
| 2026-10-17 |
WPSEC-2026-1165 |
Appointment Booking Plugin | Appointment Booking Plugin <= 5.7.4 - Authenticated (LatePoint Agent+) Insecure Direct Object Reference to Customer Information Disclosure |
Medium 4.3 |
5.7.5 |
| 2026-10-17 |
WPSEC-2026-1164 |
Appointment Booking Plugin | Appointment Booking Plugin <= 5.7.4 - Unauthenticated Payment Bypass via 'payment_portion' Parameter |
Medium 5.3 |
5.7.5 |
| 2026-10-17 |
WPSEC-2026-1163 |
MapSVG – Vector maps, Image maps, Google Maps | MapSVG – Vector maps, Image maps, Google Maps <= 8.16.1 - Authenticated (Contributor+) Arbitrary File Deletion via Import Preflight File Path |
High 8.1 |
8.16.2 |
| 2026-10-17 |
WPSEC-2026-1162 |
MapSVG – Vector maps, Image maps, Google Maps | MapSVG – Vector maps, Image maps, Google Maps <= 8.16.1 - Authenticated (Contributor+) SQL Injection via Schema Field Definitions |
High 8.8 |
8.16.2 |
| 2026-10-17 |
WPSEC-2026-1161 |
MapSVG – Vector maps, Image maps, Google Maps | MapSVG – Vector maps, Image maps, Google Maps <= 8.16.1 - Authenticated (Contributor+) Arbitrary File Upload via CSV Import Preflight |
High 8.8 |
8.16.2 |
| 2026-10-17 |
WPSEC-2026-1160 |
MapSVG – Vector maps, Image maps, Google Maps | MapSVG – Vector maps, Image maps, Google Maps <= 8.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map JavaScript Options |
Medium 6.4 |
8.16.2 |
| 2026-10-17 |
WPSEC-2026-1159 |
MapSVG – Vector maps, Image maps, Google Maps | MapSVG – Vector maps, Image maps, Google Maps <= 8.16.1 - Unauthenticated Sensitive Information Exposure via Posts REST Route |
Medium 5.3 |
8.16.2 |
| 2026-10-17 |
WPSEC-2026-1158 |
MapSVG – Vector maps, Image maps, Google Maps | MapSVG – Vector maps, Image maps, Google Maps <= 8.16.1 - Unauthenticated Sensitive Information Exposure via Collection REST Routes |
High 7.5 |
8.16.2 |
| 2026-10-17 |
WPSEC-2026-1157 |
WPGraphQL | WPGraphQL <= 2.24.1 - Unauthenticated Sensitive Information Exposure via User, Post and Term Mutation Error Messages |
Medium 5.3 |
2.24.2 |
| 2026-10-17 |
WPSEC-2026-1156 |
WPGraphQL | WPGraphQL <= 2.24.1 - Authenticated (Author+) Server-Side Request Forgery via createMediaItem Remote URL |
Medium 4.9 |
2.24.2 |
| 2026-10-17 |
WPSEC-2026-1155 |
WPGraphQL | WPGraphQL <= 2.24.1 - Authenticated (Subscriber+) Sensitive Information Exposure via updateComment and deleteComment Error Messages |
Medium 4.3 |
2.24.2 |
| 2026-10-17 |
WPSEC-2026-1154 |
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce | Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.26 - Authenticated (Custom+) Missing Authorization to Order Status Manipulation and Attendee Reassignment |
Low 2.7 |
4.1.27 |
| 2026-10-17 |
WPSEC-2026-1153 |
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce | Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.26 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Post Featured Image Modification |
Medium 4.3 |
4.1.27 |
| 2026-10-17 |
WPSEC-2026-1152 |
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce | Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.26 - Authenticated (Contributor+) Sensitive Information Exposure via Event Organizer/Speaker Assignment and Speaker/Organizer Events Shortcodes |
Medium 4.3 |
4.1.27 |
| 2026-10-17 |
WPSEC-2026-1151 |
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce | Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.26 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure via Speaker REST API |
Medium 4.3 |
4.1.27 |
| 2026-10-17 |
WPSEC-2026-1150 |
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce | Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.26 - Unauthenticated Payment Bypass via WooCommerce Order Linking |
Medium 5.3 |
4.1.27 |
| 2026-10-17 |
WPSEC-2026-1149 |
Themify Builder | Themify Builder <= 7.8.2 - Unauthenticated CSS Injection via tb_generate_on_fly AJAX Action |
Low 3.7 |
7.8.3 |
| 2026-10-17 |
WPSEC-2026-1148 |
Themify Builder | Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider 'visible' Attribute |
Medium 6.4 |
7.8.3 |
| 2026-10-17 |
WPSEC-2026-1147 |
Themify Builder | Themify Builder <= 7.8.2 - Unauthenticated Arbitrary Mailing List Subscription via Optin Module |
Medium 5.3 |
7.8.3 |
| 2026-10-17 |
WPSEC-2026-1146 |
Themify Builder | Themify Builder <= 7.8.2 - Unauthenticated Sensitive Information Exposure via Search & Filter Meta Parameters |
Medium 5.3 |
7.8.3 |
| 2026-10-17 |
WPSEC-2026-1145 |
Themify Popup | Themify Popup <= 1.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Popup Style Settings |
Medium 6.4 |
1.4.8 |
| 2026-10-17 |
WPSEC-2026-1144 |
Disabled Source, Disabled Right Click and Content Protection | Disabled Source, Disabled Right Click and Content Protection <= 1.8.2 - Unauthenticated PHP Object Injection via IP Geolocation Lookup |
High 8.1 |
1.8.3 |
| 2026-10-17 |
WPSEC-2026-1143 |
Awesome Support | Awesome Support <= 6.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Ticket Attachment MIME Type Confusion |
Medium 4.9 |
6.4.2 |
| 2026-10-16 |
WPSEC-2026-1142 |
Bookit — Booking & Appointment Calendar | Bookit — Booking & Appointment Calendar <= 2.6.0.5 - Unauthenticated Payment Bypass via 'payment_status' Parameter |
Medium 5.3 |
2.6.0.6 |
| 2026-10-16 |
WPSEC-2026-1141 |
Event Tickets and Registration | Event Tickets and Registration <= 5.30.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Ticket and Attendee Deletion |
Medium 4.3 |
5.30.2 |
| 2026-10-16 |
WPSEC-2026-1140 |
The Events Calendar | The Events Calendar <= 6.18.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Elementor Widget HTML Tag Settings |
Medium 6.4 |
6.18.2 |
| 2026-10-16 |
WPSEC-2026-1139 |
SureCart | SureCart <= 4.9.5 - Unauthenticated Open Redirect via Checkout 'success_url' Metadata |
Medium 6.1 |
4.9.6 |
| 2026-10-16 |
WPSEC-2026-1138 |
SureCart | SureCart <= 4.9.5 - Unauthenticated Sensitive Information Exposure via Product REST API List Endpoints |
Medium 5.3 |
4.9.6 |
| 2026-10-16 |
WPSEC-2026-1137 |
SureCart | SureCart <= 4.9.5 - Unauthenticated Authentication Bypass via Passwordless Login Code Brute Force |
High 8.1 |
4.9.6 |
| 2026-10-16 |
WPSEC-2026-1136 |
CMP – Coming Soon & Maintenance Plugin by NiteoThemes | CMP – Coming Soon & Maintenance Plugin by NiteoThemes <= 4.1.20 - Unauthenticated Coming Soon/Maintenance Mode Bypass via Custom Whitelist URL Patterns |
Low 3.7 |
4.1.21 |
| 2026-10-16 |
WPSEC-2026-1135 |
Happierleads | Happierleads <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Client ID Setting |
Medium 6.4 |
3.1.0 |
| 2026-10-16 |
WPSEC-2026-1134 |
Ninja Forms | Ninja Forms <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution via Merge Tags |
High 7.3 |
3.15.6 |
| 2026-10-16 |
WPSEC-2026-1133 |
Ninja Forms | Ninja Forms <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting via Submission 'calculations' Extra Data |
High 7.2 |
3.15.6 |
| 2026-10-16 |
WPSEC-2026-1132 |
Ninja Forms | Ninja Forms <= 3.15.5 - Reflected Cross-Site Scripting via Query String Merge Tags in HTML Fields |
Medium 6.1 |
3.15.6 |
| 2026-10-16 |
WPSEC-2026-1131 |
WebberZone Top 10 | WebberZone Top 10 <= 4.5.3 - Unauthenticated Sensitive Information Exposure via Popular Posts REST Endpoint |
Medium 5.3 |
4.6.0 |
| 2026-10-16 |
WPSEC-2026-1130 |
WebberZone Top 10 | WebberZone Top 10 <= 4.5.3 - Unauthenticated Sensitive Information Exposure via Password-Protected Post Thumbnails |
Medium 5.3 |
4.6.0 |
| 2026-10-16 |
WPSEC-2026-1129 |
WebberZone Top 10 | WebberZone Top 10 <= 4.5.3 - Unauthenticated Sensitive Information Exposure via Cached Popular Posts Lists |
Low 3.7 |
4.6.0 |
| 2026-10-16 |
WPSEC-2026-1128 |
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery | Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.5.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image IPTC Metadata |
Medium 6.4 |
4.5.3 |
| 2026-10-16 |
WPSEC-2026-1127 |
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery | Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.5.2 - Authenticated (Contributor+) Local File Inclusion via Shortcode Attributes |
High 8.8 |
4.5.3 |
| 2026-10-16 |
WPSEC-2026-1126 |
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery | Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.5.2 - Authenticated (Author+) Insecure Direct Object Reference to Album Modification and Deletion via Lightroom and XML-RPC |
Medium 5.4 |
4.5.3 |
| 2026-10-16 |
WPSEC-2026-1125 |
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery | Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.5.2 - Authenticated (Contributor+) PHP Object Injection via Shortcode Template Attribute |
High 7.5 |
4.5.3 |
| 2026-10-16 |
WPSEC-2026-1124 |
Iptanus File Upload | Iptanus File Upload <= 5.2.0 - Unauthenticated Information Exposure via 'params_index' Parameter |
Medium 5.3 |
5.2.1 |
| 2026-10-16 |
WPSEC-2026-1123 |
Fast Index | Fast Index <= 2.2 - Unauthenticated Sensitive Information Exposure via Publicly Stored Service Account Key Files |
Medium 5.9 |
3.0.0 |
| 2026-10-16 |
WPSEC-2026-1122 |
Fast Index | Fast Index <= 2.2 - Cross-Site Request Forgery to Arbitrary File Upload, Settings Update and Service Account Key Deletion |
High 8.8 |
3.0.0 |
| 2026-10-16 |
WPSEC-2026-1121 |
Webmention | Webmention <= 5.10.1 - Unauthenticated Stored Cross-Site Scripting via Webmention Entry Name |
High 7.2 |
5.10.2 |
| 2026-10-16 |
WPSEC-2026-1120 |
bbPress | bbPress <= 2.6.19 - Unauthenticated Sensitive Information Exposure via Forum Attachments |
Medium 5.3 |
2.6.20 |
| 2026-10-16 |
WPSEC-2026-1119 |
bbPress | bbPress <= 2.6.19 - Unauthenticated Sensitive Information Exposure via Single Reply Pages |
Medium 5.3 |
2.6.20 |
| 2026-10-16 |
WPSEC-2026-1118 |
bbPress | bbPress <= 2.6.19 - Authenticated (Subscriber+) Missing Authorization to Topic and Reply Creation in Password-Protected Forums |
Medium 4.3 |
2.6.20 |
| 2026-10-16 |
WPSEC-2026-1117 |
Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro | Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro <= 7.4.5 - Authenticated (Author+) Insecure Direct Object Reference to Arbitrary Post Modification via REST API update_subscriber 'ID' Parameter |
Medium 4.3 |
7.5.0 |
| 2026-10-16 |
WPSEC-2026-1116 |
Better Messages | Better Messages <= 3.0.14 - Authenticated (Subscriber+) Sensitive Information Exposure via 'reply_to' Message Meta in AI Chat Bot Conversations |
Low 3.1 |
3.1.0 |
| 2026-10-16 |
WPSEC-2026-1115 |
Better Messages | Better Messages <= 3.0.14 - Authenticated (Subscriber+) Sensitive Information Exposure of Pending Moderation Messages via 'lazyPool' REST Endpoint |
Medium 4.3 |
3.1.0 |
| 2026-10-16 |
WPSEC-2026-1114 |
Blocksy Companion | Blocksy Companion <= 2.1.59 - Cross-Site Request Forgery to Extension Deactivation via Incorrect License Handler |
Medium 4.3 |
2.1.60 |
| 2026-10-16 |
WPSEC-2026-1113 |
Events Made Easy | Events Made Easy <= 3.2.22 - Unauthenticated Missing Authorization to Invite-Only Event Booking |
Medium 5.3 |
3.2.23 |
| 2026-10-16 |
WPSEC-2026-1112 |
Events Made Easy | Events Made Easy <= 3.2.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via Location Map Balloons |
Medium 6.4 |
3.2.23 |
| 2026-10-16 |
WPSEC-2026-1111 |
Events Made Easy | Events Made Easy <= 3.2.22 - Authenticated (Subscriber+) Missing Authorization via Spoofed Referer Header |
Medium 4.3 |
3.2.23 |
| 2026-10-16 |
WPSEC-2026-1110 |
Events Made Easy | Events Made Easy <= 3.2.22 - Unauthenticated Insecure Direct Object Reference to Person Record Modification via Booking, Membership and Task Signup Forms |
Medium 5.3 |
3.2.23 |
| 2026-10-16 |
WPSEC-2026-1109 |
UpdraftPlus | UpdraftPlus <= 1.26.9 - Unauthenticated SQL Injection via Database Restore |
High 7.5 |
1.26.10 |
| 2026-10-16 |
WPSEC-2026-1108 |
Simple Banner | Simple Banner <= 3.3.2 - Authenticated (Subscriber+) Privilege Escalation via User Permissions Setting |
High 7.5 |
3.3.3 |
| 2026-10-16 |
WPSEC-2026-1107 |
GeoDirectory | GeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via X/Twitter Username Custom Field |
Medium 6.4 |
2.8.193 |
| 2026-10-16 |
WPSEC-2026-1106 |
CP Multi View Events Calendar | CP Multi View Events Calendar <= 1.4.42 - Unauthenticated Stored Cross-Site Scripting via Event Title |
Medium 5.4 |
1.4.43 |
| 2026-10-16 |
WPSEC-2026-1105 |
Passster – Password Protect Pages and Content | Passster – Password Protect Pages and Content <= 4.3.18 - Unauthenticated Category-Locked Content Disclosure via Taxonomy Feeds, Archives and REST API |
Medium 5.3 |
4.3.19 |
| 2026-10-16 |
WPSEC-2026-1104 |
WebinarIgnition – Live, Automated & Evergreen Webinar System also for WooCommerce | WebinarIgnition – Live, Automated & Evergreen Webinar System also for WooCommerce <= 4.20.01 - Unauthenticated Sensitive Information Exposure via 'cookie' Parameter in Lead Lookup AJAX Handler |
Medium 5.3 |
4.24.0 |
| 2026-10-16 |
WPSEC-2026-1103 |
Quick PayPal Payments: Payment Button & Form | Quick PayPal Payments: Payment Button & Form <= 6.0.4 - Unauthenticated Reflected Cross-Site Scripting via 'form' Parameter |
Medium 6.1 |
6.0.5 |
| 2026-10-16 |
WPSEC-2026-1102 |
Backup and Staging by WP Time Capsule | Backup and Staging by WP Time Capsule <= 1.22.27 - Missing Authorization to Authenticated (Subscriber+) Staging-to-Live Push |
High 8.1 |
1.22.28 |
| 2026-10-16 |
WPSEC-2026-1101 |
CM HIPAA Forms | CM HIPAA Forms <= 3.3.1 - Authenticated (HIPAA Forms Role+) Privilege Escalation via HIPAA Role Capability Update |
High 8.8 |
3.3.2 |
| 2026-10-16 |
WPSEC-2026-1100 |
CM HIPAA Forms | CM HIPAA Forms <= 3.3.1 - Unauthenticated Email Content Injection via Form Submission Notification Parameters |
Medium 5.3 |
3.3.2 |
| 2026-10-16 |
WPSEC-2026-1099 |
CM HIPAA Forms | CM HIPAA Forms <= 3.3.1 - Authenticated (HIPAA Forms Role+) Insecure Direct Object Reference to Unassigned Form Submissions |
High 7.1 |
3.3.2 |
| 2026-10-16 |
WPSEC-2026-1098 |
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas | Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.10 - Authenticated (Salon Staff+) Server-Side Request Forgery via 'image_url' Parameter |
Medium 5.5 |
10.31.11 |
| 2026-10-16 |
WPSEC-2026-1097 |
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas | Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.10 - Authenticated (Salon Staff+) Stored Cross-Site Scripting via SVG Image Upload |
Medium 5.5 |
10.31.11 |
| 2026-10-16 |
WPSEC-2026-1096 |
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas | Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.10 - Authenticated (Salon Staff+) Missing Authorization to Administrator Demotion and Arbitrary User Deletion |
Medium 6.7 |
10.31.11 |
| 2026-10-16 |
WPSEC-2026-1095 |
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas | Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.10 - Authenticated (Subscriber+) Missing Authorization to Salon Data Read via REST API |
Medium 4.3 |
10.31.11 |
| 2026-10-16 |
WPSEC-2026-1094 |
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas | Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.10 - Authenticated (Salon Staff+) Privilege Escalation via Customer User Meta |
High 7.2 |
10.31.11 |
| 2026-10-16 |
WPSEC-2026-1093 |
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas | Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.10 - Cross-Site Request Forgery to Arbitrary User Deletion |
High 8.1 |
10.31.11 |
| 2026-10-16 |
WPSEC-2026-1092 |
FAZ Cookie Manager | FAZ Cookie Manager <= 1.34.0 - Unauthenticated Web Cache Poisoning via Crawler User-Agent |
Low 3.7 |
1.34.1 |
| 2026-10-16 |
WPSEC-2026-1091 |
Form Maker by 10Web | Form Maker by 10Web <= 1.15.49 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload |
High 7.2 |
1.15.50 |
| 2026-10-16 |
WPSEC-2026-1090 |
Photo Gallery by 10Web | Photo Gallery by 10Web <= 1.8.47 - Cross-Site Request Forgery to Gallery Bulk Actions |
Medium 5.4 |
1.8.48 |
| 2026-10-16 |
WPSEC-2026-1089 |
Photo Gallery by 10Web | Photo Gallery by 10Web <= 1.8.47 - Reflected Cross-Site Scripting via 'page' Parameter |
Medium 6.1 |
1.8.48 |
| 2026-10-16 |
WPSEC-2026-1088 |
Conversational Forms for ChatBot | Conversational Forms for ChatBot <= 1.5.1 - Unauthenticated PHP Object Injection via Form Entry Answer |
High 8.1 |
1.5.2 |
| 2026-10-16 |
WPSEC-2026-1087 |
Docket Cache | Docket Cache <= 26.04.09 - Unauthenticated PHP Object Injection via Object Cache Values |
High 8.1 |
26.04.10 |
| 2026-10-16 |
WPSEC-2026-1086 |
Docket Cache | Docket Cache <= 26.04.09 - Unauthenticated Sensitive Information Exposure of WP-CLI OPcache Shared Secret |
Medium 6.5 |
26.04.10 |
| 2026-10-16 |
WPSEC-2026-1085 |
Docket Cache | Docket Cache <= 26.04.09 - Reflected Cross-Site Scripting via 'nx' and 'nv' Parameters |
Medium 6.1 |
26.04.10 |
| 2026-10-16 |
WPSEC-2026-1084 |
Booking Package | Booking Package <= 1.7.31 - Unauthenticated Payment Bypass via Booking Submission |
Medium 5.3 |
1.7.32 |
| 2026-10-16 |
WPSEC-2026-1083 |
Nexter Extension | Nexter Extension <= 4.7.12 - Authenticated (Contributor+) Sensitive Information Exposure via Display Conditions Pickers |
Medium 4.3 |
4.7.13 |
| 2026-10-16 |
WPSEC-2026-1082 |
Nexter Extension | Nexter Extension <= 4.7.12 - Unauthenticated CAPTCHA Bypass via Missing Cloudflare Turnstile Token |
Medium 5.3 |
4.7.13 |
