CVE-2026-16650

Charitable < 1.8.12 - Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass

The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpcharitable

Products

Wordpress Charitable

CVE-2026-17559

Content Protector (Passster) < 4.3.9 - Unauthenticated Protected Content Disclosure via REST Path Allowlist Bypass

The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an unanchored substring of the request URI rather than against the resolved route, allowing an unauthenticated attacker to read the content of globally password-protected posts and pages.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Passster Project Wordpress

Products

Passster Wordpress

CVE-2026-18356

Limit Login Attempts Reloaded < 3.3.5 - Username Denylist Bypass via Case Variant and Account Email

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Limit Login Attempts Project Wordpress

Products

Limit Login Attempts Wordpress

CVE-2026-3985

Creative Mail – Easier WordPress & WooCommerce Email Marketing <= 1.6.9 - Unauthenticated SQL Injection via 'checkout_uuid' Parameter

The Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin for WordPress is vulnerable to SQL Injection via the 'checkout_uuid' parameter in all versions up to, and including, 1.6.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the `has_checkout_consent()` method. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Constantcontact Wordpress

Products

Creative Mail – Easier Wordpress & Woocommerce Email Marketing Wordpress

CVE-2026-66591

WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. This issue affects Media LIbrary Assistant: from n/a through 3.39.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Davidlingren Wordpress

Products

Media Library Assistant Wordpress

CVE-2026-18409

WPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit relies on the plugin's own wp_kses_allowed_html filter widening the 'post' allowlist to permit iframe elements with a data-src attribute, which is not on WordPress's URI-attribute sanitization list, allowing a javascript: URI stored in data-src to survive kses processing and subsequently be promoted to a live src attribute by the bundled admin script view-entry.min.js.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpforms

Products

Wordpress Wpforms Pro

CVE-2026-16577

Dokan < 5.0.14 - Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied Amount

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a client-supplied payment amount against the vendor's actual outstanding balance when recording a reverse-withdrawal payment, allowing a vendor to credit their reverse-withdrawal ledger with an arbitrary amount and clear their real commission debt without paying.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Dokan Wordpress

Products

Ai Powered Woocommerce Multivendor Marketplace Solution:dokan: Ai Powered Woocommerce Multivendor Marketplace Solution Wordpress

CVE-2026-19085

Copy & Delete Posts < 1.5.6 - Author+ Password-Protected Post Content Disclosure

The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Duplicate Post Project Wordpress

Products

Duplicate Post Wordpress

CVE-2026-75796

AI Engine 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User Tools

The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network, including the Network Administrator's.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Ai Engine Project Wordpress

Products

Ai Engine Wordpress

CVE-2026-16962

Tamara Checkout <= 1.9.9.20 - Unauthenticated Order Status Manipulation

The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any capability on its public payment cancel/fail return URLs, changing a WooCommerce order's status based solely on an attacker-supplied numeric order id, so an unauthenticated attacker can cancel or fail arbitrary orders store-wide by enumerating ids (triggering downstream stock-release and notification side-effects).

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tamara Checkout Wordpress

Products

Tamara Checkout Wordpress

CVE-2026-18781

Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Drag And Drop Multiple File Uploader Pro - Contact Form 7 Project Wordpress

Products

Drag And Drop Multiple File Uploader Pro - Contact Form 7 Wordpress

CVE-2026-19435

Copy & Delete Posts < 1.5.6 - Authenticated Arbitrary Post Content and Password Disclosure

The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Duplicate Post Project Wordpress

Products

Duplicate Post Wordpress

CVE-2026-15150

myCred < 3.2.5 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification in buyCRED

The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a payment for the expected amount to a gateway account they control rather than the site's.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mycred Wordpress

Products

Mycred Wordpress

CVE-2025-15671

Welcart e-Commerce < 2.12.1 - Session Fixation via uscesid Parameter

The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account after the victim logs in through an attacker-crafted request.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Welcart Wordpress

Products

Welcart E-commerce Wordpress

CVE-2026-14601

Link Whisper < 0.9.7 - Editor+ SQL Injection via domain Parameter

The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Linkwhisper Wordpress

Products

Link Whisper Free Wordpress

CVE-2026-16959

Media Library Assistant < 3.40 - Author+ SQL Injection via mla_search_connector

The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection.

CVSS 3.1 · 6.8 Medium EPSS 1.3% KEV · Not listed

Vendors

Media Library Assistant Project Wordpress

Products

Media Library Assistant Wordpress

CVE-2026-13176

Eventin < 4.1.21 - Contributor+ Server-Side Request Forgery

The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Eventin Wordpress

Products

Eventin Wordpress

CVE-2026-19848

ProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution via Display Name

The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public pages, allowing unauthenticated attackers to store shortcodes that are then executed when the page is viewed, disclosing a chosen user's email address, login and registration date.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Profilepress Wordpress

Products

Profilepress Wordpress

CVE-2026-16576

Dokan < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST API

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14-installation capability, allowing users such as Shop Managers to install and activate arbitrary Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 from WordPress.org.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Dokan Wordpress

Products

Ai Powered Woocommerce Multivendor Marketplace Solution:dokan: Ai Powered Woocommerce Multivendor Marketplace Solution Wordpress

CVE-2026-16575

Dokan < 5.0.14 - Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not restrict access to per-vendor commission configuration returned by one of its unauthenticated store REST endpoints, allowing any unauthenticated user to disclose a vendor's commission type and, when category-based commission is configured, the per-category and default commission rates.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Dokan Wordpress

Products

Ai Powered Woocommerce Multivendor Marketplace Solution:dokan: Ai Powered Woocommerce Multivendor Marketplace Solution Wordpress