Threat database

CVE-2026-94261 is a medium severity vulnerability in the Sifalo Pay WordPress plugin before version 2.5.3. It allows unauthenticated attackers who possess a valid payment transaction identifier from their own payment to mark arbitrary pending orders as paid. This occurs because the plugin does not verify that the payment transaction identifier belongs to the order it is confirming, nor does it verify that the requester owns the order.

CVE-2026-94260 is a missing authorization vulnerability in the Sifalo Pay WordPress plugin versions 2.0 up to but not including 2.5.3. It allows unauthenticated attackers to modify payment session metadata on any order and to force orders awaiting payment into a failed state. This flaw arises because the plugin does not verify ownership or authorization when processing payment returns.

CVE-2026-94254 is a vulnerability in the SellKit WordPress plugin versions 2.3.5 up to but not including 2.8.0. It allows unauthenticated attackers to manipulate product prices during checkout by exploiting missing authorization checks, enabling them to place orders at arbitrary prices. The vulnerability has a medium severity rating with a CVSS score of 5.3.

CVE-2026-92426 is an authorization vulnerability in the YITH WooCommerce Popup WordPress plugin before version 1.60.0. The plugin fails to verify user capabilities before allowing deletion of post meta data. This flaw permits users with the Contributor role or higher to delete arbitrary post meta from any post, including those owned by users with higher privileges.

CVE-2026-92409 is a cross-site scripting (XSS) vulnerability in the Donation Thermometer WordPress plugin versions 2.2.9 up to but not including 2.3.0. The flaw arises because the plugin does not properly escape a colour value taken from a shortcode attribute before inserting it into the legend markup. This allows users with Contributor role or higher to inject arbitrary event handlers that execute when the page is viewed.

CVE-2026-91076 is a vulnerability in the Robokassa payment gateway plugin for WooCommerce versions before 1.9.0. The plugin fails to verify the authenticity of incoming payment-notification requests, allowing unauthenticated attackers to mark any WooCommerce order as failed. Since order identifiers are sequential, attackers can systematically disrupt order fulfillment by targeting orders one by one.

CVE-2026-90989 is an information exposure vulnerability in the Tainacan WordPress plugin versions before 1.4.0. The plugin's reports REST endpoints do not restrict access to users with management capabilities, allowing any authenticated subscriber to read email addresses of the repository's staff. This vulnerability has a medium severity with a CVSS score of 4.3.

CVE-2026-89288 is a high-severity SQL injection vulnerability in the Fast Courier WordPress plugin versions 5.0.0 up to but not including 5.2.4. The flaw arises because the plugin fails to sanitize and escape input on an unauthenticated REST API route, allowing attackers to inject SQL commands. This can lead to unauthorized reading of arbitrary data from the database without authentication.

CVE-2026-88927 is a medium severity vulnerability in the rtMedia plugin for WordPress, BuddyPress, and bbPress versions before 4.7.14. It allows users with subscriber-level or higher accounts to upload media into private albums owned by other users without proper authorization checks. This flaw arises because the plugin does not verify ownership or write permissions for the album to which media is assigned.

CVE-2026-87974 is a medium severity vulnerability in the Asaas Gateway for WooCommerce WordPress plugin before version 2.7.8. The plugin does not properly authenticate its payment webhook, accepting an empty access token by default and failing to verify that the confirmed payment matches the order marked as paid. This allows unauthenticated attackers to mark arbitrary orders as paid.

A vulnerability in the Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before version 5.3.2 allows unauthenticated users to trigger an AJAX action that re-registers the store and overwrites the stored shop secret. This occurs because the plugin does not perform nonce or capability checks on the relevant AJAX action.

CVE-2026-87843 is a vulnerability in the Trust Payments Gateway for WooCommerce WordPress plugin before version 3.1.0. The plugin fails to verify the authenticity of the payment provider's response when a customer returns from the hosted payment page. It also does not bind the response to the targeted order or verify the payment amount. This allows unauthenticated attackers to mark arbitrary orders as paid without actual payment and to access order and customer details.

CVE-2026-86799 is a high-severity cross-site scripting (XSS) vulnerability in the Forms WordPress plugin before version 3.0.2. The plugin fails to sanitize submitted form values on storage and does not escape them before displaying on the form submissions screen in the admin dashboard. This allows unauthenticated users to inject malicious scripts that execute in the browsers of administrators viewing submissions.

CVE-2026-86797 is a cross-site scripting (XSS) vulnerability in the Pricing Table WordPress plugin before version 2.1.5. It occurs because the plugin does not validate the scheme of a user-supplied link value in one of its blocks before rendering. This allows users with contributor-level access or higher to store malicious scripts that execute when other users view or interact with the affected content.

CVE-2026-86787 is a high-severity vulnerability in the affiliate-toolkit WordPress plugin versions 3.8.7 up to but not including 3.9.1. It allows users with Contributor role or higher to supply a template body that is compiled and executed as PHP code by the plugin's templating engine, leading to arbitrary code execution on the server.

CVE-2026-85345 is a Server-Side Request Forgery (SSRF) vulnerability in the FV Flowplayer Video Player WordPress plugin versions from 7.5.44.7212 up to but not including 7.5.55.7212. It allows users with Contributor-level access or higher to cause the server to perform HTTP requests to internal resources. The vulnerability arises because the plugin does not properly validate user-supplied URLs and the existing host-based restrictions are incomplete. The impact is limited to revealing whether an internal resource responds and its HTTP status code; the contents of the resource are not disclosed to the attacker.

EmbedPress WordPress plugin versions before 4.6.8 have an improper access control vulnerability. Unauthenticated attackers can trigger server-side requests to third-party APIs using the site owner's credentials and inject attacker-controlled cache entries into the site's database. This can lead to unauthorized consumption of the site owner's third-party API quota and unbounded database record creation.

Sunshine Photo Cart WordPress plugin versions before 3.7.4 allow unauthenticated attackers to submit comments to restricted galleries without verifying access permissions. This flaw permits injection of attacker-chosen content with arbitrary author names and emails into galleries that are password-protected, email-gated, private, account-only, or expired. The plugin properly checks permissions when displaying comments but fails to do so on comment submission.

CVE-2026-108066 is a low-severity vulnerability in the WP 2FA WordPress plugin versions before 4.2.0. It allows a site administrator on WordPress Multisite installations to remove the two-factor authentication (2FA) configuration of users outside their own site without proper authorization checks. This bypasses object-level capability checks and crosses a trust boundary specific to Multisite environments. Single-site installations are not affected in this way since administrators can already manage all users.

CVE-2026-108064 is a vulnerability in the WP Encryption WordPress plugin versions before 7.8.8.2. It lacks proper authorization checks on a handler involved in SSL certificate provisioning, allowing unauthenticated users to overwrite the site's certificate private key and replace pending Let's Encrypt order and challenge data. This can disrupt certificate issuance by repeatedly regenerating challenge material, preventing administrators from completing the process.