WordPress CVEs

CVE-2026-16562 August 8, 2026

The WP Statistics WordPress plugin before 14.16.10 does not perform a capability check on a set of dashboard analytics AJAX handlers, relying only on a nonce that every authenticated user holds, allowing users with… Full details

MEDIUM 6.5

CVE-2026-16559 August 8, 2026

The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and… Full details

MEDIUM 6.8

CVE-2026-16558 August 8, 2026

The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not verify object ownership when the setting is saved,… Full details

MEDIUM 5.4

CVE-2026-16535 August 8, 2026

The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can… Full details

MEDIUM 6.1

CVE-2026-16282 August 8, 2026

The Appointment Hour Booking WordPress plugin before 1.5.88 does not validate a client-supplied booking price against the server-side configured service price, allowing unauthenticated users to submit an arbitrary final price (including zero or negative)… Full details

MEDIUM 5.3

CVE-2026-16269 August 8, 2026

The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing unauthenticated attackers to bypass the API authentication via type juggling and perform privileged actions such as modifying subscriber records… Full details

MEDIUM 4.8

CVE-2026-16267 August 8, 2026

The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects. Full details

HIGH 8.1

CVE-2026-14526 August 8, 2026

The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.6. This is due to the plugin not properly verifying that a user… Full details

CRITICAL 9.8

CVE-2026-18988 August 8, 2026

The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block attribute in versions up to, and including, 3.1.8. This is due to insufficient input sanitization and output escaping… Full details

MEDIUM 6.4

CVE-2026-64638 August 7, 2026

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an… Full details

HIGH 8.9

CVE-2026-48093 August 7, 2026

The Code Embed WordPress plugin prior to version 2.6.1 is vulnerable to stored Cross-Site Scripting (XSS) through the external URL embed feature in post content. The vulnerable code scans rendered content for URL embed… Full details

MEDIUM 6.5

CVE-2026-48094 August 7, 2026

The ShareOpenly WordPress plugin prior to version 1.2.1 contains a Cross-Site Scripting vulnerability caused by the absence of WordPress's `esc_url()` escaping function on the `$url` variable before it is rendered into HTML content. This… Full details

MEDIUM 5.3

CVE-2026-15239 August 7, 2026

The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request… Full details

MEDIUM 5.3

CVE-2026-15211 August 7, 2026

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied… Full details

MEDIUM 5.9

CVE-2026-15148 August 7, 2026

The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated… Full details

MEDIUM 5.3

CVE-2026-16265 August 7, 2026

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to… Full details

MEDIUM 6.5

CVE-2026-16263 August 7, 2026

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion,… Full details

HIGH 8.8

CVE-2026-16262 August 7, 2026

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account… Full details

HIGH 7.5

CVE-2026-16258 August 7, 2026

The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed… Full details

CRITICAL 9.8

CVE-2026-16041 August 7, 2026

The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name,… Full details

HIGH 7.5

CVE-2026-16039 August 7, 2026

The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with… Full details

MEDIUM 6.5

CVE-2026-16038 August 7, 2026

The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark… Full details

CRITICAL 9.1

CVE-2026-16030 August 7, 2026

The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to… Full details

HIGH 8.1

CVE-2026-15386 August 7, 2026

The Meow Gallery WordPress plugin before 5.5.2 does not escape an attachment's alt text before outputting it into an attribute of the link it builds for linked galleries, allowing users with the Author role… Full details

MEDIUM 5.4

CVE-2026-15361 August 7, 2026

The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing… Full details

HIGH 8.1

CVE-2026-15359 August 7, 2026

The Templately WordPress plugin before 3.7.1 does not have an authorisation check on one of its request handlers, allowing unauthenticated attackers to overwrite the administrator's stored cloud service connection with an account under their… Full details

MEDIUM 6.5

CVE-2026-15245 August 7, 2026

The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to… Full details

MEDIUM 5.4

CVE-2026-15215 August 7, 2026

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied slug through a nonce-protected AJAX… Full details

HIGH 8.8

CVE-2026-15214 August 7, 2026

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another customer's subscription information (the… Full details

MEDIUM 4.3

CVE-2026-15032 August 7, 2026

The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing unauthenticated users to store a Cross-Site Scripting payload that executes in the browser… Full details

MEDIUM 6.1

CVE-2026-14943 August 7, 2026

The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated… Full details

HIGH 7.5

CVE-2026-14331 August 7, 2026

The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated… Full details

MEDIUM 6.1

CVE-2026-14205 August 7, 2026

The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create… Full details

CRITICAL 9.8

CVE-2026-14365 August 7, 2026

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that… Full details

CRITICAL 9.8

CVE-2026-14364 August 7, 2026

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to account takeover via improper password reset validation in all versions up to, and including, 1.2.3. This is due to the… Full details

CRITICAL 9.8

CVE-2026-12801 August 7, 2026

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' attributes in all versions up to, and including, 3.5.43 due to… Full details

MEDIUM 6.4

CVE-2026-11907 August 7, 2026

The Stream plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.0. This is due to the plugin not properly verifying that a user is authorized to perform… Full details

MEDIUM 6.5

CVE-2026-5336 August 6, 2026

The DataPress (Dataverse Integration) WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as… Full details

MEDIUM 6.8

CVE-2026-16620 August 6, 2026

The WPC Name Your Price for WooCommerce WordPress plugin before 2.2.5 does not enforce its server-side price allowlist for products configured in "Select" price mode, allowing an unauthenticated visitor to add such a product… Full details

HIGH 7.5

CVE-2026-16619 August 6, 2026

The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already… Full details

HIGH 7.5

CVE-2026-16067 August 6, 2026

The Event Booking Manager for WooCommerce (Pro) WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native (non-WooCommerce) checkout, trusting the per-ticket price supplied by the client instead… Full details

MEDIUM 5.3

CVE-2026-15256 August 6, 2026

The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes… Full details

MEDIUM 4.8

CVE-2026-15208 August 6, 2026

The RegistrationMagic WordPress plugin before 6.0.9.5 does not compare the verified PayPal capture's amount, currency, payee, or prior use against the registration it is finalising: its server-side check only confirms the capture status is… Full details

MEDIUM 5.3

CVE-2026-15152 August 6, 2026

The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking… Full details

MEDIUM 5.3

CVE-2026-15149 August 6, 2026

The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total are non-negative when placing a booking, and relies on client-controlled cart data, allowing unauthenticated users… Full details

MEDIUM 5.3

CVE-2026-15147 August 6, 2026

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the… Full details

MEDIUM 5.3

CVE-2026-14936 August 6, 2026

The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership, allowing unauthenticated users to activate or… Full details

MEDIUM 5.3

CVE-2026-14842 August 6, 2026

The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowing unauthenticated attackers to pay a low amount for a cheap booking and… Full details

MEDIUM 5.3

CVE-2026-14831 August 6, 2026

The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking duration on the server side when adding to cart and calculating the booking price, allowing unauthenticated users to… Full details

MEDIUM 5.3

CVE-2026-14812 August 6, 2026

The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code execution, server-side request forgery and arbitrary front-end script/content… Full details

CRITICAL 10