The Contest Gallery WordPress plugin (up to version 32.0.1) contains an Unauthenticated Arbitrary File Overwrite vulnerability due to insufficient validation of the 'baseUrlForFacebook' parameter. This flaw allows authenticated users with subscriber-level access or higher to overwrite files, potentially leading to remote code execution under certain conditions. The vulnerability is classified under CWE-434 and has a high severity rating with a CVSS score of 8.8.

CVE-2026-78088 describes an Unauthenticated Arbitrary File Overwrite vulnerability in the Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe WordPress plugin. The issue arises from inadequate file path validation in the 'baseUrlForFacebook' parameter, enabling authenticated users with subscriber-level privileges or above to overwrite existing files. This can lead to remote code execution if specific preconditions are met. The vulnerability affects all versions up to and including 32.0.1.

CVE Database V5

Detailed information about CVE-2026-78088: CWE-434 Unrestricted Upload of File with Dangerous Type in contest-gallery Contest Gallery – Upload & Vote Photos, Me

CVE-2026-78088: CWE-434 Unrestricted Upload of File with Dangerous Type in contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-78088: CWE-434 Unrestricted Upload of File with Dangerous Type in contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe

WP-Lister Lite for eBay WordPress plugin versions up to 3.8.9 are vulnerable to a stored cross-site scripting (XSS) flaw via an AJAX Cron Handler request parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when a user accesses the affected page. The issue arises from insufficient input sanitization and output escaping.

CVE-2026-18595 is a stored cross-site scripting vulnerability in the WP-Lister Lite for eBay WordPress plugin. The flaw exists in all versions up to and including 3.8.9 due to improper neutralization of input in an AJAX Cron Handler request parameter. This allows unauthenticated attackers to inject arbitrary web scripts that execute in the context of users visiting the injected page, potentially leading to session hijacking or other script-based attacks.

Detailed information about CVE-2026-18595: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in wp-lab WP-Lister Lite 

CVE-2026-18595: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in wp-lab WP-Lister Lite for eBay - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-18595: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in wp-lab WP-Lister Lite for eBay

WP Directory Kit plugin for WordPress versions up to 1.5.4 is vulnerable to a blind SQL Injection via the 'order_by' parameter. Authenticated users with custom-level access or higher can exploit this vulnerability to append SQL queries and extract sensitive database information. The vulnerability arises from insufficient escaping and lack of proper query preparation.

CVE-2026-16588 describes a blind SQL Injection vulnerability in the WP Directory Kit WordPress plugin affecting all versions up to and including 1.5.4. The flaw is due to improper neutralization of special elements in the 'order_by' parameter, allowing authenticated attackers with custom-level access or above to inject additional SQL commands into existing queries. This can lead to unauthorized extraction of sensitive data from the database. The CVSS 3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

Detailed information about CVE-2026-16588: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in wpdirectorykit WP Dire

CVE-2026-16588: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in wpdirectorykit WP Directory Kit - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-16588: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in wpdirectorykit WP Directory Kit

The TrueBooker – Appointment Booking and Scheduler System WordPress plugin up to version 1.2.3 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to modify the email addresses of arbitrary user accounts, including administrators. Exploiting this can enable attackers to reset passwords and gain unauthorized access to affected accounts. The vulnerability is identified as CWE-862 (Missing Authorization) and has a critical CVSS score of 9.8.

CVE-2026-14349 describes an authorization bypass vulnerability in the TrueBooker plugin for WordPress, versions up to and including 1.2.3. The plugin fails to properly verify user authorization before allowing certain actions, specifically permitting unauthenticated attackers to change the email address of any user account. This can be leveraged to reset passwords and take over accounts, including those with administrative privileges. The vulnerability is categorized under CWE-862 (Missing Authorization) and has a CVSS v3.1 base score of 9.8, indicating critical severity.

Detailed information about CVE-2026-14349: CWE-862 Missing Authorization in themetechmount TrueBooker – Appointment Booking and Scheduler System affecting theme

CVE-2026-14349: CWE-862 Missing Authorization in themetechmount TrueBooker – Appointment Booking and Scheduler System - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-14349: CWE-862 Missing Authorization in themetechmount TrueBooker – Appointment Booking and Scheduler System

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin is affected by a critical privilege escalation vulnerability in all versions up to and including 3.6.2. The flaw arises because the plugin does not verify that a submitted form ID corresponds to a JetFormBuilder form before processing the form schema and executing server-side validation callbacks. This allows unauthenticated attackers to escalate privileges by creating new administrator-level user accounts.

CVE-2026-12793 is a critical privilege escalation vulnerability (CWE-269) in the JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin. The vulnerability exists because the plugin fails to validate that a submitted form ID belongs to a legitimate JetFormBuilder form before parsing the referenced post content as a form schema and executing an advanced validation callback on the server side. This improper privilege management enables unauthenticated attackers to create new administrator accounts, effectively gaining full control over the affected WordPress site. The vulnerability affects all versions from 0 up to and including 3.6.2.

Detailed information about CVE-2026-12793: CWE-269 Improper Privilege Management in jetmonsters JetFormBuilder — Dynamic Blocks Form Builder affecting jetmonste

CVE-2026-12793: CWE-269 Improper Privilege Management in jetmonsters JetFormBuilder — Dynamic Blocks Form Builder - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-12793: CWE-269 Improper Privilege Management in jetmonsters JetFormBuilder — Dynamic Blocks Form Builder

Rejected reason: This CVE ID was assigned in error as a duplicate of CVE-2026-70496, which describes the same vulnerability. Please use CVE-2026-70496 instead.

GCVE Database

Detailed information about Rejected reason: This CVE ID was assigned in error as a duplicate of CVE-2026-70496, which describes the same vulnerability. (CVE-202

Rejected reason: This CVE ID was assigned in error as a duplicate of CVE-2026-70496, which describes the same vulnerability. (CVE-2026-66790) - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-66790 has been rejected

Official rejection reason

Replacement CVE