WordPress CVEs

CVE-2026-17016 August 10, 2026

The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total in its PayPal Data Transfer return handler, allowing a customer… Full details

LOW 3.7

CVE-2026-17012 August 10, 2026

The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment matches the merchant's configured account before marking the order as… Full details

MEDIUM 5.3

CVE-2026-17010 August 10, 2026

The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level access and above to inject stored Cross-Site Scripting payloads that… Full details

MEDIUM 5.4

CVE-2026-16985 August 10, 2026

The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the upload_files capability (Author and… Full details

HIGH 8.8

CVE-2026-16949 August 10, 2026

The Term Pages WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks. Full details

MEDIUM 5.8

CVE-2026-16299 August 10, 2026

The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to… Full details

CRITICAL 9.8

CVE-2026-16298 August 10, 2026

The FoodBoxBooker WordPress plugin before 1.0.7 does not properly validate the password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover. Full details

CRITICAL 9.8

CVE-2026-16257 August 10, 2026

The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access control can be bypassed by unauthenticated users through type juggling when… Full details

HIGH 8.2

CVE-2026-15238 August 10, 2026

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account (Subscriber and above) to modify or overwrite the personal… Full details

MEDIUM 5.4

CVE-2026-15237 August 10, 2026

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary… Full details

MEDIUM 5.3

CVE-2026-15229 August 10, 2026

The Pinpoint Booking System WordPress plugin through 2.9.9.7.1 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price (including zero) and, by selecting a… Full details

MEDIUM 5.3

CVE-2026-15047 August 10, 2026

The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer… Full details

MEDIUM 6.8

CVE-2026-14941 August 10, 2026

The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-related AJAX actions, allowing users with minimal permissions such as Subscribers to invoke administrative settings handlers,… Full details

MEDIUM 5.4

CVE-2026-14860 August 10, 2026

The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read… Full details

MEDIUM 5.3

CVE-2026-14293 August 10, 2026

The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that value when it is later output… Full details

HIGH 8.8

CVE-2026-14238 August 10, 2026

The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users… Full details

MEDIUM 4.1

CVE-2026-14237 August 10, 2026

The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability… Full details

HIGH 7.2

CVE-2026-14211 August 10, 2026

The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee (provider) is related to the customer whose record is being accessed, allowing any employee with an… Full details

LOW 3.8

CVE-2026-14206 August 10, 2026

The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data (name, email, phone,… Full details

HIGH 7.5

CVE-2026-13701 August 10, 2026

The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the site, which could allow administrators (including those without the… Full details

MEDIUM 4.8

CVE-2026-13600 August 10, 2026

The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task… Full details

HIGH 8.1

CVE-2026-13170 August 10, 2026

The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with editor-level access and above to include and execute arbitrary… Full details

HIGH 7.2

CVE-2026-12971 August 10, 2026

The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts,… Full details

LOW 2.2

CVE-2026-18603 August 9, 2026

The PiWeb Cancel order / Refund request for WooCommerce WordPress plugin before 1.3.4.34 does not have authorization or ownership checks when adding the contents of a previous order to the cart, allowing unauthenticated users… Full details

MEDIUM 6.5

CVE-2026-18473 August 9, 2026

The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users. Full details

CRITICAL 9.1

CVE-2026-18465 August 9, 2026

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled… Full details

MEDIUM 6.5

CVE-2026-18464 August 9, 2026

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it… Full details

HIGH 7.5

CVE-2026-18357 August 9, 2026

The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unauthenticated attackers to retrieve sensitive order data belonging to any… Full details

HIGH 7.5

CVE-2026-18037 August 9, 2026

The Create WordPress plugin before 2.5.4 does not perform an authorization check before rendering content over one of its public REST API routes, and that route additionally publishes the requested content as a side… Full details

MEDIUM 6.5

CVE-2026-18032 August 9, 2026

The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guarding that action does not cover them, allowing… Full details

HIGH 7.5

CVE-2026-17044 August 9, 2026

The Iptanus File Upload WordPress plugin before 5.1.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by unauthenticated users. Full details

HIGH 8.6

CVE-2026-17017 August 9, 2026

The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action, and does not include a capability check on… Full details

HIGH 8.1

CVE-2026-17014 August 9, 2026

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public REST endpoint actions, allowing unauthenticated users to delete the generated album export… Full details

MEDIUM 5.3

CVE-2026-17011 August 9, 2026

The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor role to store arbitrary CSS that… Full details

LOW 3.8

CVE-2026-16992 August 9, 2026

The Create WordPress plugin before 2.5.4 does not perform an authorization check before returning content over one of its REST API routes, and that route additionally publishes the requested content as a side effect,… Full details

MEDIUM 6.5

CVE-2026-16988 August 9, 2026

The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of… Full details

HIGH 7.5

CVE-2026-16965 August 9, 2026

The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber (and, via CSRF, any logged-in user)… Full details

MEDIUM 4.3

CVE-2026-16957 August 9, 2026

The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, allowing users with the Contributor role to read… Full details

LOW 2.7

CVE-2026-16032 August 9, 2026

The LWS Optimize WordPress plugin before 4.1.2 does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboard, allowing unauthenticated attackers to inject… Full details

MEDIUM 6.1

CVE-2026-15038 August 9, 2026

The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own… Full details

CRITICAL 9.8

CVE-2026-16955 August 8, 2026

The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary… Full details

MEDIUM 5

CVE-2026-16953 August 8, 2026

The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot files before deletion, authorising the action solely by a client-supplied session cookie value, so an unauthenticated attacker who… Full details

MEDIUM 4.8

CVE-2026-16948 August 8, 2026

The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users… Full details

HIGH 8.1

CVE-2026-16608 August 8, 2026

The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary… Full details

MEDIUM 5.3

CVE-2026-16595 August 8, 2026

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site's… Full details

MEDIUM 6.5

CVE-2026-16594 August 8, 2026

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the WP… Full details

HIGH 7.5

CVE-2026-16590 August 8, 2026

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact… Full details

MEDIUM 6.5

CVE-2026-16589 August 8, 2026

The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce… Full details

HIGH 7.7

CVE-2026-16578 August 8, 2026

The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers… Full details

HIGH 7.5

CVE-2026-16574 August 8, 2026

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.11 does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST… Full details

MEDIUM 5.4