https://vulnogram.org/ Most recent CVEs assigned by WPScan (wpscan). https://vulnogram.org/seaview/icons/wpscan.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-96901 https://vulnogram.org/CVE-2026-96901 The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token format, allowing unauthenticated attackers who know a… Wed, 21 Oct 2026 06:00:26 GMT https://vulnogram.org/CVE-2026-92999 https://vulnogram.org/CVE-2026-92999 The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not perform any authorization check on a lead-export handler, allowing unauthenticated users to download every captured contact record (names, email addresses and phone num… Wed, 21 Oct 2026 06:00:26 GMT https://vulnogram.org/CVE-2026-92998 https://vulnogram.org/CVE-2026-92998 The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks. Wed, 21 Oct 2026 06:00:25 GMT https://vulnogram.org/CVE-2026-92997 https://vulnogram.org/CVE-2026-92997 The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. Wed, 21 Oct 2026 06:00:25 GMT https://vulnogram.org/CVE-2026-88784 https://vulnogram.org/CVE-2026-88784 The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a translated language, and reverses the encoding that was applied to them beforehand, allowing unauthent… Wed, 21 Oct 2026 06:00:25 GMT https://vulnogram.org/CVE-2026-87838 https://vulnogram.org/CVE-2026-87838 The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public REST endpoints, allowing unauthenticated attackers to overwrite the stored credential that identifies the mer… Wed, 21 Oct 2026 06:00:25 GMT https://vulnogram.org/CVE-2026-87837 https://vulnogram.org/CVE-2026-87837 The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in th… Wed, 21 Oct 2026 06:00:25 GMT https://vulnogram.org/CVE-2026-86611 https://vulnogram.org/CVE-2026-86611 The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, inc… Wed, 21 Oct 2026 06:00:25 GMT https://vulnogram.org/CVE-2026-85642 https://vulnogram.org/CVE-2026-85642 The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the daily allowance… Wed, 21 Oct 2026 06:00:24 GMT https://vulnogram.org/CVE-2026-81813 https://vulnogram.org/CVE-2026-81813 The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements and attributes, allowing users with the Contributor role and above to store a payload which breaks out when the… Wed, 21 Oct 2026 06:00:24 GMT https://vulnogram.org/CVE-2026-81812 https://vulnogram.org/CVE-2026-81812 The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run in the browser of any user wh… Wed, 21 Oct 2026 06:00:24 GMT https://vulnogram.org/CVE-2026-79627 https://vulnogram.org/CVE-2026-79627 The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not st… Wed, 21 Oct 2026 06:00:24 GMT https://vulnogram.org/CVE-2026-15261 https://vulnogram.org/CVE-2026-15261 The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its REST API that it applies on the front-end, allowing unauthenticated users to read the metadata and item contents of private wishlist… Wed, 21 Oct 2026 06:00:23 GMT https://vulnogram.org/CVE-2026-111957 https://vulnogram.org/CVE-2026-111957 The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not bind the payment it confirms with the provider to the order being completed, nor check the payment amount against the order total, allowing unauthenticated users to mark… Wed, 21 Oct 2026 06:00:23 GMT https://vulnogram.org/CVE-2026-111956 https://vulnogram.org/CVE-2026-111956 The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, includi… Wed, 21 Oct 2026 06:00:23 GMT https://vulnogram.org/CVE-2026-111955 https://vulnogram.org/CVE-2026-111955 The WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before comparing it with the one supplied in a request, allowing unauthenticated users to activate pending accounts and bypass the administrato… Wed, 21 Oct 2026 06:00:23 GMT https://vulnogram.org/CVE-2026-111949 https://vulnogram.org/CVE-2026-111949 The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenti… Wed, 21 Oct 2026 06:00:22 GMT https://vulnogram.org/CVE-2026-111948 https://vulnogram.org/CVE-2026-111948 The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to Reflected Cross-Site Scripting against high-privilege users. Wed, 21 Oct 2026 06:00:22 GMT https://vulnogram.org/CVE-2026-111947 https://vulnogram.org/CVE-2026-111947 The Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perform authorisation checks when duplicating a legacy pricing table, allowing users with the contributor role and above to clone and publish any post or page on the site, incl… Wed, 21 Oct 2026 06:00:22 GMT https://vulnogram.org/CVE-2026-111596 https://vulnogram.org/CVE-2026-111596 The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unauthenticated users to retrieve the billing location,… Wed, 21 Oct 2026 06:00:22 GMT https://vulnogram.org/CVE-2026-111574 https://vulnogram.org/CVE-2026-111574 The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug metabox, allowing unauthenticated attackers to store a malicious script th… Wed, 21 Oct 2026 06:00:22 GMT https://vulnogram.org/CVE-2026-110982 https://vulnogram.org/CVE-2026-110982 The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and excerpt, allowing users with the Editor role and above to modify arbitrary posts of any type, including co… Wed, 21 Oct 2026 06:00:22 GMT https://vulnogram.org/CVE-2026-110651 https://vulnogram.org/CVE-2026-110651 The Swift Performance Lite WordPress plugin before 2.3.7.4 does not properly sanitize and escape a value before using it in a SQL statement, which could allow users with the author role and above to perform SQL injection attacks. Wed, 21 Oct 2026 06:00:21 GMT https://vulnogram.org/CVE-2026-110523 https://vulnogram.org/CVE-2026-110523 The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowi… Wed, 21 Oct 2026 06:00:21 GMT https://vulnogram.org/CVE-2026-110514 https://vulnogram.org/CVE-2026-110514 The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order, which could allow users with the contributor role and above to convert any other user's posts and pages… Wed, 21 Oct 2026 06:00:21 GMT https://vulnogram.org/CVE-2026-109926 https://vulnogram.org/CVE-2026-109926 The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbi… Wed, 21 Oct 2026 06:00:21 GMT https://vulnogram.org/CVE-2026-109147 https://vulnogram.org/CVE-2026-109147 The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as ad… Wed, 21 Oct 2026 06:00:21 GMT https://vulnogram.org/CVE-2026-108073 https://vulnogram.org/CVE-2026-108073 The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API, nor strip private fields from those objects, allowing unauthenticated users… Wed, 21 Oct 2026 06:00:21 GMT https://vulnogram.org/CVE-2026-107790 https://vulnogram.org/CVE-2026-107790 The HireZoot WordPress plugin before 4.1.1 does not sanitise and escape some of its stored data before outputting it in the admin dashboard, and additionally reverses the HTML-entity encoding that would otherwise neutralise it, allowing users with th… Wed, 21 Oct 2026 06:00:20 GMT https://vulnogram.org/CVE-2026-107789 https://vulnogram.org/CVE-2026-107789 The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and… Wed, 21 Oct 2026 06:00:20 GMT https://vulnogram.org/CVE-2026-107788 https://vulnogram.org/CVE-2026-107788 The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders sto… Wed, 21 Oct 2026 06:00:20 GMT https://vulnogram.org/CVE-2026-107506 https://vulnogram.org/CVE-2026-107506 The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such roles the full administrator capability, which allows users in a low-pr… Wed, 21 Oct 2026 06:00:20 GMT https://vulnogram.org/CVE-2026-107237 https://vulnogram.org/CVE-2026-107237 The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time… Wed, 21 Oct 2026 06:00:19 GMT https://vulnogram.org/CVE-2026-107128 https://vulnogram.org/CVE-2026-107128 The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mar… Wed, 21 Oct 2026 06:00:19 GMT https://vulnogram.org/CVE-2026-107127 https://vulnogram.org/CVE-2026-107127 The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen… Wed, 21 Oct 2026 06:00:19 GMT https://vulnogram.org/CVE-2026-106932 https://vulnogram.org/CVE-2026-106932 The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authentica… Wed, 21 Oct 2026 06:00:19 GMT https://vulnogram.org/CVE-2026-105999 https://vulnogram.org/CVE-2026-105999 The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notifi… Wed, 21 Oct 2026 06:00:19 GMT https://vulnogram.org/CVE-2026-105998 https://vulnogram.org/CVE-2026-105998 The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31'… Wed, 21 Oct 2026 06:00:18 GMT https://vulnogram.org/CVE-2026-105996 https://vulnogram.org/CVE-2026-105996 The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriving them instead from values it exposes publicly, so an unauthenticated attacker can reconstruct an arbitrary b… Wed, 21 Oct 2026 06:00:18 GMT https://vulnogram.org/CVE-2026-105992 https://vulnogram.org/CVE-2026-105992 The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the payment provider before marking it paid and confirmed, allowing unauthenticated attackers to mark bookings as paid without paying. Wed, 21 Oct 2026 06:00:18 GMT https://vulnogram.org/CVE-2026-105262 https://vulnogram.org/CVE-2026-105262 The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user through an unprotected handler, allowing users with Subscriber-level access… Wed, 21 Oct 2026 06:00:18 GMT https://vulnogram.org/CVE-2026-105257 https://vulnogram.org/CVE-2026-105257 The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate the personal… Wed, 21 Oct 2026 06:00:18 GMT https://vulnogram.org/CVE-2026-103302 https://vulnogram.org/CVE-2026-103302 The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the merchant credentials used to compute their checksum are empty by default, allowing unauthenticated attackers t… Wed, 21 Oct 2026 06:00:17 GMT https://vulnogram.org/CVE-2026-102499 https://vulnogram.org/CVE-2026-102499 The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level… Wed, 21 Oct 2026 06:00:16 GMT https://vulnogram.org/CVE-2026-100145 https://vulnogram.org/CVE-2026-100145 The Synchrony Financing WordPress plugin before 1.1.2 does not properly authorise requests to one of its REST routes that modifies WooCommerce orders, allowing unauthenticated attackers to reassign any order to an account they control, tamper with it… Wed, 21 Oct 2026 06:00:16 GMT https://vulnogram.org/CVE-2026-96903 https://vulnogram.org/CVE-2026-96903 The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact… Medium Tue, 20 Oct 2026 06:00:15 GMT https://vulnogram.org/CVE-2026-96902 https://vulnogram.org/CVE-2026-96902 The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking… Medium Network Exploitable Tue, 20 Oct 2026 06:00:14 GMT https://vulnogram.org/CVE-2026-94294 https://vulnogram.org/CVE-2026-94294 The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built fr… Medium Mon, 19 Oct 2026 06:46:21 GMT https://vulnogram.org/CVE-2026-94272 https://vulnogram.org/CVE-2026-94272 The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail. Medium Mon, 19 Oct 2026 06:46:20 GMT https://vulnogram.org/CVE-2026-94231 https://vulnogram.org/CVE-2026-94231 The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices. Medium Mon, 19 Oct 2026 06:46:19 GMT