CVE Notifier

CVE-2026-91014 CWE-? N/A

Realtyna Organic IDX plugin + WPL Real Estate < 5.4.2 - Reflected XSS via Location Selector Endpoint

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page, allowing unauthenticated attackers to run arbit…

WPScan Unknown:Realtyna · Organic · IDX 6 hari lalu

CVE-2026-91011 CWE-? N/A

EWWW Image Optimizer < 8.7.7 - Author+ Stored XSS via Image Class Attribute Backreference Expansion

The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary Jav…

WPScan Unknown:EWWW · Image · Optimizer 6 hari lalu

CVE-2026-91010 CWE-? N/A

Invisible Anti-Spam & CAPTCHA < 5.1.1 - Subscriber+ Arbitrary Form Submission Deletion

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action, and only tests that a nonce parameter is p…

WPScan Unknown:Invisible · Anti-Spam · & 6 hari lalu

CVE-2026-91009 CWE-? N/A

Active Products Tables for WooCommerce < 2.1.3 - Subscriber+ Arbitrary Post Title Modification via woot_update_attachment

The Active Woot Products Tables for WooCommerce. 100% FREE  WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some of its AJAX actions, allowing any authenticated users, such as subscriber, to …

WPScan Unknown:Active · Woot · Products 6 hari lalu

CVE-2026-91008 CWE-? N/A

Event Booking Manager for WooCommerce < 5.3.8 - Unauthenticated Attendee PII Disclosure via Booking Confirmation Panel

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve …

WPScan Unknown:Event · Booking · Manager 6 hari lalu

CVE-2026-90923 CWE-? N/A

Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders.

WPScan Unknown:Autopay 6 hari lalu

CVE-2026-90922 CWE-? N/A

Paid Member Subscriptions < 3.0.9 - Unauthenticated Membership Payment Bypass via PayPal Standard Amount and Currency Mismatch

The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pending payment before completing it, allowing unauthenticated user…

WPScan Unknown:Paid · Membership · Subscriptions 6 hari lalu

CVE-2026-88904 CWE-? N/A

PuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation

The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, includi…

WPScan Unknown:PuppyFW 6 hari lalu

CVE-2026-88795 CWE-? N/A

wpShopGermany IT-RECHT KANZLEI < 2.4 - Unauthenticated RCE via Predictable API Token

The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is s…

WPScan Unknown:wpShopGermany · IT-RECHT · KANZLEI 6 hari lalu

CVE-2026-88792 CWE-? N/A

Dictionary <= 1.0 - Unauthenticated Stored XSS via Direct Dictionary Update

The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which w…

WPScan Unknown:Dictionary 6 hari lalu

CVE-2026-87836 CWE-? N/A

Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export

The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Au…

WPScan Unknown:Comments · Import · & 6 hari lalu

CVE-2026-87786 CWE-? N/A

Dewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout Coordinates

The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allowing unauthenticated users to store JavaScript that runs in th…

WPScan Unknown:Dewa · Kirim 6 hari lalu