CVE-2026-18391

WooCommerce Subscriptions < 9.1.0 - Unauthenticated RCE via PHP Object Injection

The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Woocommerce Wordpress

Products

Subscriptions Wordpress

CVE-2026-18474

WP Directory Kit < 1.5.6 - Unauthenticated SQL Injection via search_location and search_category

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpdirectorykit

Products

Wordpress Wp Directory Kit

CVE-2026-16574

Dokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.11 does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST endpoints, allowing an authenticated vendor to grant their own customer free download access to another vendor's paid downloadable files.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Dokan Wordpress

Products

Ai Powered Woocommerce Multivendor Marketplace Solution:dokan: Ai Powered Woocommerce Multivendor Marketplace Solution Wordpress

CVE-2026-16608

Download Monitor < 5.2.6 - Unauthenticated Download Log Injection

The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Download Monitor Wordpress

Products

Download Monitor Wordpress

CVE-2026-16948

Solace Extra < 1.6.1 - Subscriber+ Multiple Missing Authorization via Site-Wide Nonce Exposure

The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and delete imported site-builder content.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Solacewp Wordpress

Products

Solace Extra Wordpress

CVE-2026-17540

Bit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch

The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's configuration secrets and to denial of service.

CVSS 3.1 · 8.8 High EPSS 1.8% KEV · Not listed

Vendors

Filemanagerpro Wordpress

Products

File Manager Wordpress

CVE-2026-19049

ProSolution WP Client < 2.0.9 - Unauthenticated SQLi and Plugin Data Deletion via 'removesite' Cookie

The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on every request without any authentication or capability check, allowing unauthenticated users to read arbitrary data from the database and to delete the records the ProSolution WP Client WordPress plugin before 2.0.9 stores.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Prosolution Wordpress

Products

Prosolution Wp Client Wordpress

CVE-2026-15229

Pinpoint Booking System <= 2.9.9.7.1 - Unauthenticated Arbitrary Booking Price Manipulation

The Pinpoint Booking System WordPress plugin through 2.9.9.7.1 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price (including zero) and, by selecting a specific payment method, obtain an instantly-approved reservation.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Pinpoint Wordpress

Products

Pinpoint Booking System Wordpress

CVE-2026-17023

Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Google Calendar Connection Hijack via OAuth Callback

The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Google Calendar connection tokens with attacker-controlled ones and hijack the integration. Exploitation requires the site to have configured its own Google OAuth client for the calendar feature.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Salonbookingsystem Wordpress

Products

Salon Booking System Wordpress

CVE-2026-19077

Copy & Delete Posts < 1.5.5 - Authenticated Arbitrary Post Deletion via Missing Object-Level Authorization

The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site, including those belonging to other users.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Duplicate Post Project Wordpress

Products

Duplicate Post Wordpress

CVE-2026-16230

Formidable Digital Signatures <= 3.0.6 - Unauthenticated Arbitrary File Deletion via Signature Field

The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the delete_file function in all versions up to, and including, 3.0.6. This makes it possible for unauthenticated attackers to delete files on the server by supplying an attacker-controlled filename in the item_meta[field_id][content] parameter alongside the delete_saved_image flag during the standard entry-creation POST flow on any form that accepts anonymous submissions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Strategy11 Wordpress

Products

Formidable Digital Signatures Wordpress

CVE-2026-13457

InstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the (top-level script) function. This is due to the plugin stores its encrypted options file as options-{migrate_key}.txt in wp-content/instawpbackups/ without deploying an index.php or .htaccess to prevent directory listing, exposing the 40-character migrate_key on Apache servers with directory indexing enabled, which allows an attacker to derive the AES-256-CBC passphrase via SHA256(migrate_key), decrypt the options file to recover the api_signature. This makes it possible for unauthenticated attackers to get the database access details and api_signature. Exploitation requires the target WordPress site to be hosted on Apache with directory listing enabled (Options +Indexes) for the wp-content/instawpbackups/ directory, and time limited because it can only be exploited during the migration period.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Instawp Wordpress

Products

Instawp Connect – 1-click Wp Staging & Migration Wordpress

CVE-2026-18961

Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect <= 1.4.3 - Unauthenticated Authentication Bypass via Spotify OAuth Callback

The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3. This is due to the plugin trusting the unverified email field returned by Spotify's /v1/me endpoint as proof of mailbox ownership — Generic::normalize_common() copies this value into the normalized profile without requiring an email_verified assertion, and User_Links::link_or_login_user() subsequently passes it directly to get_user_by('email', $email) and issues a persistent authentication cookie via wp_set_auth_cookie() without a provider-specific verified-email gate, a local mailbox challenge, or a logged-in approval step. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including Administrators, by supplying a known target email address through a controlled Spotify OAuth flow, gaining full administrative access to the site.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Fahdaslam Wordpress

Products

Social Login, Passkeys, Magic Link & Email Otp – Passwordless Login By Ventraconnect Wordpress

CVE-2026-14211

Amelia Pro < 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDOR

The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee (provider) is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any customer by enumerating sequential identifiers.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed

Vendors

Ameliabooking Wordpress

Products

Booking For Appointments And Events Calendar Wordpress

CVE-2026-14548

Ray Enterprise Translation <= 1.7.3 - Subscriber+ Arbitrary API Token Update

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Lingotek-translation Wordpress

Products

Ray Enterprise Translation Wordpress

CVE-2026-14549

Ray Enterprise Translation <= 1.7.3 - Subscriber+ Language Addition and Deletion

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Lingotek-translation Wordpress

Products

Ray Enterprise Translation Wordpress

CVE-2026-18789

Ezoic < 2.23.1 - Unauthenticated Database Export via Content Export REST Routes

The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently change some of its settings.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ezoic Wordpress

Products

Ezoic Wordpress

CVE-2026-12976

LearnPress < 4.4.4 - Subscriber+ Sensitive Information Exposure via AI Assistant

The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Learnpress Wordpress

Products

Learnpress Wordpress

CVE-2026-5391

LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping in the 'locations' branch of the 'shortcode_latepoint_resources' function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Latepoint Wordpress

Products

Appointment Booking Plugin – Latepoint | Calendar & Scheduling For Wordpress Wordpress

CVE-2026-13168

Eventin < 4.1.20 - Contributor+ Customer PII Disclosure via REST API

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Eventin Wordpress

Products

Eventin Wordpress