| 2026-10-08 |
WPSEC-2026-0682 |
Envira Gallery | Envira Gallery <= 1.16.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Private Post Title and Excerpt Disclosure via gallery_data REST Field |
Medium 4.3 |
1.16.2 |
| 2026-10-08 |
WPSEC-2026-0681 |
Envira Gallery | Envira Gallery <= 1.16.1 - Authenticated (Contributor+) Sensitive Information Exposure of Private Galleries via Gallery Shortcode |
Medium 4.3 |
1.16.2 |
| 2026-10-08 |
WPSEC-2026-0680 |
Patreon WordPress | Patreon WordPress <= 1.9.17 - Cross-Site Request Forgery to Account Takeover via OAuth Callback |
High 8.1 |
1.10.0 |
| 2026-10-08 |
WPSEC-2026-0679 |
Patreon WordPress | Patreon WordPress <= 1.9.17 - Unauthenticated Open Redirect via 'final_redirect_uri' State Parameter |
Medium 4.7 |
1.10.0 |
| 2026-10-08 |
WPSEC-2026-0678 |
PPOM for WooCommerce | PPOM for WooCommerce <= 34.0.10 - Unauthenticated Price Manipulation via 'price_matrix_found' Parameter |
Medium 5.3 |
34.0.11 |
| 2026-10-08 |
WPSEC-2026-0677 |
PPOM for WooCommerce | PPOM for WooCommerce <= 34.0.10 - Unauthenticated Path Traversal to Arbitrary File Move via File Upload Field Names |
High 8.1 |
34.0.11 |
| 2026-10-08 |
WPSEC-2026-0676 |
Order Export & Order Import for WooCommerce | Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive Information Exposure via Predictable Export File Names |
Medium 5.9 |
2.7.9 |
| 2026-10-08 |
WPSEC-2026-0675 |
Tainacan | Tainacan <= 1.3.0 - Authenticated (Editor+) PHP Object Injection via Metadata Order and Type Options |
High 7.2 |
1.4.0 |
| 2026-10-08 |
WPSEC-2026-0674 |
Tainacan | Tainacan <= 1.3.0 - Authenticated (Editor+) Arbitrary File Read via Importer Source File |
Medium 4.9 |
1.4.0 |
| 2026-10-08 |
WPSEC-2026-0673 |
Tainacan | Tainacan <= 1.3.0 - Authenticated (Subscriber+) Sensitive Information Exposure via Reports REST Endpoints |
Medium 4.3 |
1.4.0 |
| 2026-10-08 |
WPSEC-2026-0672 |
Travelpayouts | Travelpayouts <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Search Form Modification and Stored Cross-Site Scripting |
Medium 6.4 |
1.2.4 |
| 2026-10-08 |
WPSEC-2026-0671 |
WP Plugin Info Card | WP Plugin Info Card <= 6.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout' and 'expiration' Shortcode Attributes |
Medium 6.4 |
6.4.0 |
| 2026-10-08 |
WPSEC-2026-0670 |
Constant Contact Forms | Constant Contact Forms <= 2.22.0 - Improper Authentication to Unauthenticated Mailing List Subscription of Arbitrary Users via Login Opt-in |
Medium 5.3 |
2.22.1 |
| 2026-10-08 |
WPSEC-2026-0669 |
Reviews Feed | Reviews Feed <= 2.14.0 - Unauthenticated Sensitive Information Exposure via Elementor Integration Feed Data |
Medium 5.3 |
2.15.0 |
| 2026-10-08 |
WPSEC-2026-0668 |
Reviews Feed | Reviews Feed <= 2.14.0 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor Feed Data |
Medium 4.3 |
2.15.0 |
| 2026-10-08 |
WPSEC-2026-0667 |
FoxyShop | FoxyShop <= 4.9.7 - Unauthenticated Privilege Escalation via Predictable API Key |
High 8.1 |
4.9.8 |
| 2026-10-08 |
WPSEC-2026-0666 |
FoxyShop | FoxyShop <= 4.9.7 - Missing Authorization to Unauthenticated Limited File Upload |
Low 3.7 |
4.9.8 |
| 2026-10-08 |
WPSEC-2026-0665 |
FoxyShop | FoxyShop <= 4.9.7 - Unauthenticated Sensitive Information Exposure via Order Export |
High 7.5 |
4.9.8 |
| 2026-10-08 |
WPSEC-2026-0664 |
WPCOM Member | WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via Social Login 'uuid' Parameter |
High 8.1 |
1.8.0.1 |
| 2026-10-08 |
WPSEC-2026-0663 |
WPCOM Member | WPCOM Member <= 1.7.27 - Cross-Site Request Forgery to Account Takeover via Social Login Binding |
High 7.5 |
1.8.0.1 |
| 2026-10-08 |
WPSEC-2026-0662 |
Pinterest for WooCommerce | Pinterest for WooCommerce <= 1.5.1 - Unauthenticated Information Exposure of Password-Protected Products via Rich Pins Metadata |
Medium 5.3 |
1.5.2 |
| 2026-10-08 |
WPSEC-2026-0661 |
Pinterest for WooCommerce | Pinterest for WooCommerce <= 1.5.1 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Settings REST Endpoint |
Medium 5.5 |
1.5.2 |
| 2026-10-08 |
WPSEC-2026-0660 |
Events Manager | Events Manager <= 7.4.6 - Unauthenticated SQL Injection via 'scope' Parameter |
High 7.5 |
7.4.7 |
| 2026-10-08 |
WPSEC-2026-0659 |
Donation Thermometer | Donation Thermometer <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'colorramp' Shortcode Attribute |
Medium 6.4 |
2.3.0 |
| 2026-10-08 |
WPSEC-2026-0658 |
Jetpack VideoPress | Jetpack VideoPress <= 3.6 - Missing Authorization to Restricted Video Playback via Subscription Plan ID |
Medium 4.3 |
3.7 |
| 2026-10-08 |
WPSEC-2026-0657 |
WooCommerce | WooCommerce <= 11.1.2 - Authenticated (Shop Manager+) Privilege Escalation via Editing Users with Multiple Roles |
Medium 6.6 |
11.2.0 |
| 2026-10-08 |
WPSEC-2026-0656 |
WooCommerce | WooCommerce <= 11.1.2 - Authenticated (Shop Manager+) Privilege Escalation via Account Takeover through Password Reset Email Cc/Bcc Recipients |
High 7.2 |
11.2.0 |
| 2026-10-08 |
WPSEC-2026-0655 |
All in One SEO | All in One SEO <= 5.0.2.1 - Authenticated (Contributor+) Missing Authorization to Image Attachment Creation and Limited Image Disclosure via AI Image Generation |
Medium 5.4 |
5.0.3 |
| 2026-10-08 |
WPSEC-2026-0654 |
Stitch Express | Stitch Express <= 1.9.1 - Unauthenticated Order Status Check Bypass via 'override' Parameter |
Low 3.7 |
1.9.3 |
| 2026-10-08 |
WPSEC-2026-0653 |
WP Booking System Free version | WP Booking System Free version <= 2.1 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header |
High 7.2 |
2.1.0.1 |
| 2026-10-08 |
WPSEC-2026-0652 |
WPAdverts – Classifieds Plugin | WPAdverts – Classifieds Plugin <= 2.3.4 - Reflected Cross-Site Scripting via '_adverts_action' Parameter |
Medium 6.1 |
2.3.5 |
| 2026-10-08 |
WPSEC-2026-0651 |
WPAdverts – Classifieds Plugin | WPAdverts – Classifieds Plugin <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via Advert Location and Contact Fields |
High 7.2 |
2.3.5 |
| 2026-10-08 |
WPSEC-2026-0650 |
YITH WooCommerce Affiliates | YITH WooCommerce Affiliates <= 3.31.0 - Authenticated (Shop Manager+) PHP Object Injection via Referral Cookie Expiration Setting |
Medium 6.6 |
3.31.1 |
| 2026-10-08 |
WPSEC-2026-0649 |
WooCommerce Accommodation Bookings | WooCommerce Accommodation Bookings <= 1.3.12 - Unauthenticated Denial of Service via Availability Cache Registry |
Medium 5.3 |
1.3.13 |
| 2026-10-08 |
WPSEC-2026-0648 |
WPML Multilingual & Multicurrency for WooCommerce | WPML Multilingual & Multicurrency for WooCommerce <= 5.5.8 - Authenticated (Shop Manager+) SQL Injection via 'currency' Parameter |
Medium 4.9 |
5.6.3 |
| 2026-10-08 |
WPSEC-2026-0647 |
WPML Multilingual & Multicurrency for WooCommerce | WPML Multilingual & Multicurrency for WooCommerce <= 5.5.8 - Unauthenticated Session Fixation via Cross-Domain Session Handoff |
Medium 4.2 |
5.6.3 |
| 2026-10-08 |
WPSEC-2026-0646 |
Shortcodes and extra features for Phlox theme | Shortcodes and extra features for Phlox theme <= 2.17.22 - Missing Authorization to Authenticated (Subscriber+) Theme License Deactivation |
Medium 4.3 |
2.17.24 |
| 2026-10-08 |
WPSEC-2026-0645 |
Shortcodes and extra features for Phlox theme | Shortcodes and extra features for Phlox theme <= 2.17.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes and Menu Widget Custom Content |
Medium 6.4 |
2.17.24 |
| 2026-10-08 |
WPSEC-2026-0644 |
Customer Email Verification for WooCommerce | Customer Email Verification for WooCommerce <= 2.8.1 - Authenticated (Contributor+) Missing Authorization to Arbitrary User Email Verification Status Modification |
Medium 4.3 |
2.8.2 |
| 2026-10-08 |
WPSEC-2026-0643 |
Accept PayPal Payments using Contact Form 7 | Accept PayPal Payments using Contact Form 7 <= 4.0.6 - Unauthenticated Missing Authorization to Arbitrary PayPal Refund |
Medium 5.3 |
4.0.7 |
| 2026-10-08 |
WPSEC-2026-0642 |
Accept PayPal Payments using Contact Form 7 | Accept PayPal Payments using Contact Form 7 <= 4.0.6 - Unauthenticated Missing Authorization to Payment Data CSV Export |
Medium 5.3 |
4.0.7 |
| 2026-10-08 |
WPSEC-2026-0641 |
Kali Forms — Contact Form & Drag-and-Drop Builder | Kali Forms — Contact Form & Drag-and-Drop Builder <= 2.4.25 - Authenticated (Author+) Stored Cross-Site Scripting via Button 'clickAction' Field Property |
Medium 5.4 |
2.4.26 |
| 2026-10-08 |
WPSEC-2026-0640 |
WP Search with Algolia | WP Search with Algolia <= 2.14.1 - Authenticated (Subscriber+) Missing Authorization to Index Re-Indexing and Settings Push |
Medium 5.4 |
3.0.0 |
| 2026-10-08 |
WPSEC-2026-0639 |
DPD Baltic Shipping | DPD Baltic Shipping <= 1.2.93 - Embedded Malicious Code (Password-Protected File Manager in uninstall-boolean.php) |
Critical 9.8 |
1.2.94 |
| 2026-10-08 |
WPSEC-2026-0638 |
ShipAny WooCommerce: Ship, Label, Tracking | ShipAny WooCommerce: Ship, Label, Tracking <= 1.1.112 - Missing Authorization to Authenticated (Subscriber+) Merchant Address Disclosure via 'on_click_update_address' AJAX Action |
Medium 4.3 |
1.1.113 |
| 2026-10-08 |
WPSEC-2026-0637 |
ShipAny WooCommerce: Ship, Label, Tracking | ShipAny WooCommerce: Ship, Label, Tracking <= 1.1.112 - Unauthenticated Sensitive Information Exposure of ShipAny API Token |
High 7.5 |
1.1.113 |
| 2026-10-08 |
WPSEC-2026-0636 |
Table Field Add-on for ACF and SCF | Table Field Add-on for ACF and SCF <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table Field Value |
Medium 6.4 |
1.4.1 |
| 2026-10-08 |
WPSEC-2026-0635 |
Product Feed Manager for WooCommerce | Product Feed Manager for WooCommerce <= 8.0.31 - Authenticated (Shop Manager+) Arbitrary Options Deletion |
Medium 6.5 |
8.0.32 |
| 2026-10-08 |
WPSEC-2026-0634 |
Product Feed Manager for WooCommerce | Product Feed Manager for WooCommerce <= 8.0.31 - Unauthenticated Sensitive Information Exposure of SFTP Password via Log Files |
Medium 5.9 |
8.0.32 |
| 2026-10-08 |
WPSEC-2026-0633 |
Product Feed Manager for WooCommerce | Product Feed Manager for WooCommerce <= 8.0.31 - Authenticated (Shop Manager+) Sensitive Information Exposure via WP Options |
Medium 4.9 |
8.0.32 |
| 2026-10-08 |
WPSEC-2026-0632 |
Visual Composer Website Builder | Visual Composer Website Builder <= 45.16.3 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure via 'vcv-source-id' Parameter |
Medium 4.3 |
45.16.4 |
| 2026-10-08 |
WPSEC-2026-0631 |
Molongui Authorship | Molongui Authorship <= 5.2.12 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Byline Link Processing |
Medium 5.4 |
5.3.0 |
| 2026-10-08 |
WPSEC-2026-0630 |
Portfolio Gallery – Image Gallery Plugin | Portfolio Gallery – Image Gallery Plugin <= 2.2.0 - Authenticated (Contributor+) Missing Authorization to Site-Wide Filter Management |
Medium 4.3 |
2.2.1 |
| 2026-10-08 |
WPSEC-2026-0629 |
Portfolio Gallery – Image Gallery Plugin | Portfolio Gallery – Image Gallery Plugin <= 2.2.0 - Authenticated (Contributor+) Missing Authorization to Media Library Image Upload |
Medium 4.3 |
2.2.1 |
| 2026-10-08 |
WPSEC-2026-0628 |
Portfolio Gallery – Image Gallery Plugin | Portfolio Gallery – Image Gallery Plugin <= 2.2.0 - Authenticated (Contributor+) Missing Authorization to Limited Attachment Deletion |
Medium 4.3 |
2.2.1 |
| 2026-10-08 |
WPSEC-2026-0627 |
Portfolio Gallery – Image Gallery Plugin | Portfolio Gallery – Image Gallery Plugin <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Title |
Medium 6.4 |
2.2.1 |
| 2026-10-08 |
WPSEC-2026-0626 |
Portfolio Gallery – Image Gallery Plugin | Portfolio Gallery – Image Gallery Plugin <= 2.2.0 - Authenticated (Contributor+) Insecure Direct Object Reference to Gallery Image Modification and Disclosure |
Medium 5.4 |
2.2.1 |
| 2026-10-08 |
WPSEC-2026-0625 |
Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages | Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages <= 3.4.5 - Authenticated (Contributor+) Missing Authorization to Kit Account Connection via OAuth Callback |
Medium 4.2 |
3.4.6 |
| 2026-10-08 |
WPSEC-2026-0624 |
Forminator Forms | Forminator Forms <= 1.57.3.1 - Unauthenticated Insecure Direct Object Reference via Stripe PaymentIntent ID |
Medium 6.5 |
1.58.0 |
| 2026-10-08 |
WPSEC-2026-0623 |
Forminator Forms | Forminator Forms <= 1.57.3.1 - Unauthenticated PayPal Order Request Tampering via Form Submission |
Medium 5.3 |
1.58.0 |
| 2026-10-08 |
WPSEC-2026-0622 |
Forminator Forms | Forminator Forms <= 1.57.3.1 - Unauthenticated CAPTCHA Bypass on Payment Forms |
Medium 5.3 |
1.58.0 |
| 2026-10-08 |
WPSEC-2026-0621 |
WP Store Locator | WP Store Locator <= 3.0.3 - Authenticated (Store Locator Manager+) Stored Cross-Site Scripting via Store Marker Meta |
Medium 5.5 |
3.1.0 |
| 2026-10-08 |
WPSEC-2026-0620 |
WP Store Locator | WP Store Locator <= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'template' Shortcode Attribute |
Medium 6.4 |
3.1.0 |
| 2026-10-08 |
WPSEC-2026-0619 |
Forminator Forms | Forminator Forms <= 1.57.3 - Unauthenticated Stored Cross-Site Scripting via Form Submission Values |
High 7.2 |
1.57.3.1 |
| 2026-10-08 |
WPSEC-2026-0618 |
Forminator Forms | Forminator Forms <= 1.57.3 - Unauthenticated Arbitrary Shortcode Execution via User-Agent Header and Referer URL |
Medium 5.6 |
1.57.3.1 |
| 2026-10-08 |
WPSEC-2026-0617 |
Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms | Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms <= 1.26.14 - Unauthenticated HTML Injection in Email Notifications via Referral Link and IP Address |
Low 3.1 |
1.26.15 |
| 2026-10-08 |
WPSEC-2026-0616 |
Official Integration for Billingo | Official Integration for Billingo <= 4.3.2 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Options Update in Email Settings |
High 7.2 |
4.3.3 |
| 2026-10-08 |
WPSEC-2026-0615 |
Official Integration for Billingo | Official Integration for Billingo <= 4.3.2 - Unauthenticated Sensitive Information Exposure via Log Files |
Medium 5.3 |
4.3.3 |
| 2026-10-08 |
WPSEC-2026-0614 |
Gutenverse Form – Contact Form Builder, Block Form & Booking Form | Gutenverse Form – Contact Form Builder, Block Form & Booking Form <= 3.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Icon Block Attributes |
Medium 6.4 |
3.0.11 |
| 2026-10-08 |
WPSEC-2026-0613 |
WP Job Manager | WP Job Manager <= 2.4.7 - Unauthenticated Sensitive Information Exposure via Listing Archives, Term Feeds, Sitemaps and REST API |
Low 3.7 |
2.4.8 |
| 2026-10-08 |
WPSEC-2026-0612 |
WP Job Manager | WP Job Manager <= 2.4.7 - Authenticated (Subscriber+) Sensitive Information Exposure via Edit Job Form Attachment Fields |
Medium 4.3 |
2.4.8 |
| 2026-10-08 |
WPSEC-2026-0611 |
WP Job Manager | WP Job Manager <= 2.4.7 - Authenticated (Contributor+) Sensitive Information Exposure via [jobs] Shortcode 'post_status' Attribute |
Medium 4.3 |
2.4.8 |
| 2026-10-08 |
WPSEC-2026-0610 |
WPComplete | WPComplete <= 2.9.5.7 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Completion Data Modification |
Medium 4.3 |
2.9.5.8 |
| 2026-10-08 |
WPSEC-2026-0609 |
WPComplete | WPComplete <= 2.9.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Course Name |
Medium 6.4 |
2.9.5.8 |
| 2026-10-08 |
WPSEC-2026-0608 |
Tabs Widget for Page Builder | Tabs Widget for Page Builder <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Nested Tab Widgets |
Medium 6.4 |
1.2.3 |
| 2026-10-07 |
WPSEC-2026-0607 |
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories | Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
Medium 6.4 |
4.10.6 |
| 2026-10-07 |
WPSEC-2026-0606 |
Social Rocket – Social Sharing Plugin | Social Rocket – Social Sharing Plugin <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'heading' Shortcode Attribute |
Medium 6.4 |
1.3.6 |
| 2026-10-07 |
WPSEC-2026-0605 |
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy | Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.7.1 - Unauthenticated Order Completion Without Confirmed Payment via Square Checkout |
Low 3.7 |
3.7.1.1 |
| 2026-10-07 |
WPSEC-2026-0604 |
RSS Aggregator by Feedzy | RSS Aggregator by Feedzy <= 5.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Loop Block |
Medium 6.4 |
5.2.11 |
| 2026-10-07 |
WPSEC-2026-0603 |
Subscribe to Comments | Subscribe to Comments <= 2.3.2 - Unauthenticated Sensitive Information Exposure via Subscriptions to Non-Public Posts |
Low 3.7 |
2.3.3 |
| 2026-10-07 |
WPSEC-2026-0602 |
Subscribe to Comments | Subscribe to Comments <= 2.3.2 - Authenticated (Subscriber+) Incorrect Authorization to Subscription Takeover via Unverified Account Email |
Medium 5.4 |
2.3.3 |
| 2026-10-07 |
WPSEC-2026-0601 |
Subscribe to Comments | Subscribe to Comments <= 2.3.2 - Unauthenticated Sensitive Information Exposure via E-mail Change Confirmation |
Medium 4.8 |
2.3.3 |
| 2026-10-07 |
WPSEC-2026-0600 |
Subscribe to Comments | Subscribe to Comments <= 2.3.2 - Cross-Site Request Forgery via Subscription Manager |
Medium 4.3 |
2.3.3 |
| 2026-10-07 |
WPSEC-2026-0599 |
Premmerce Product Filter for WooCommerce | Premmerce Product Filter for WooCommerce <= 3.8.2 - Authenticated (Subscriber+) Missing Authorization to Taxonomy Term Disclosure |
Medium 4.3 |
3.8.3 |
| 2026-10-07 |
WPSEC-2026-0598 |
GiveWP – Donation Plugin and Fundraising Platform | GiveWP – Donation Plugin and Fundraising Platform <= 4.18.0 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Standard IPN Notifications |
Low 3.7 |
4.18.0.1 |
| 2026-10-07 |
WPSEC-2026-0597 |
Kadence Blocks | Kadence Blocks <= 3.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Block Title Heading Level |
Medium 6.4 |
3.7.12.1 |
| 2026-10-07 |
WPSEC-2026-0596 |
Robokassa payment gateway for Woocommerce | Robokassa payment gateway for Woocommerce <= 1.8.9 - Unauthenticated Insecure Direct Object Reference to Order Key Exposure via 'InvId' Parameter |
Low 3.7 |
1.9.0 |
| 2026-10-07 |
WPSEC-2026-0595 |
GPTranslate | GPTranslate <= 2.34.13 - Unauthenticated Cross-Site Scripting via HTML Attribute Values in Server-Side Translated Pages |
Medium 6.1 |
2.34.14 |
| 2026-10-07 |
WPSEC-2026-0594 |
Document Engine | Document Engine <= 2.1.0 - Authenticated (Author+) Server-Side Request Forgery via Post to PDF |
Medium 6.4 |
2.2.0 |
| 2026-10-07 |
WPSEC-2026-0593 |
All in One Invite Codes | All in One Invite Codes <= 1.2.0 - Authenticated (Subscriber+) Missing Authorization to Sending Invites via Other Users' Invite Codes |
Medium 5.4 |
1.3.0 |
| 2026-10-07 |
WPSEC-2026-0592 |
All in One Invite Codes | All in One Invite Codes <= 1.2.0 - Cross-Site Request Forgery to Invite Code Creation |
Medium 4.3 |
1.3.0 |
| 2026-10-07 |
WPSEC-2026-0591 |
All in One Invite Codes | All in One Invite Codes <= 1.2.0 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Invite Code Disabling |
Medium 4.3 |
1.3.0 |
| 2026-10-07 |
WPSEC-2026-0590 |
Subscribe to Comments | Subscribe to Comments <= 2.3.1 - Authenticated (Author+) Missing Authorization to Plugin Settings Update |
Medium 6.4 |
2.3.2 |
| 2026-10-07 |
WPSEC-2026-0589 |
Subscribe to Comments | Subscribe to Comments <= 2.3.1 - Unauthenticated Sensitive Information Exposure via Subscription Management Keys |
Medium 6.5 |
2.3.2 |
| 2026-10-07 |
WPSEC-2026-0588 |
Subscribe to Comments | Subscribe to Comments <= 2.3.1 - Reflected Cross-Site Scripting via 'ref' Parameter |
Medium 6.1 |
2.3.2 |
| 2026-10-07 |
WPSEC-2026-0587 |
Booktics – Appointment Booking Calendar for Service Businesses | Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.27 - Authenticated (Subscriber+) Missing Authorization to Appointment Data and Security Token Exposure via Calendar Appointments Route |
Medium 5.4 |
1.0.28 |
| 2026-10-07 |
WPSEC-2026-0586 |
Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms | Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.10.3 - Authenticated (Contributor+) Path Traversal to Local File Inclusion via List Submissions Block |
High 8.8 |
2.10.4 |
| 2026-10-07 |
WPSEC-2026-0585 |
Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms | Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.10.3 - Unauthenticated Missing Authorization to Arbitrary Taxonomy Term Disclosure via bf_load_taxonomy AJAX Action |
Medium 5.3 |
2.10.4 |
| 2026-10-07 |
WPSEC-2026-0584 |
Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms | Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.10.2 - Unauthenticated Missing Authorization to Form Configuration Export |
Medium 5.3 |
2.10.3 |
| 2026-10-07 |
WPSEC-2026-0583 |
Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms | Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.10.0 - Unauthenticated Missing Authorization to Arbitrary Post Modification |
High 7.5 |
2.10.1 |
