WPSpeed plugin for WordPress versions up to 2.6.10 contains a stored cross-site scripting (XSS) vulnerability. This occurs due to improper handling of entity-encoded markup in the LightImages HTML optimizer, allowing authenticated users with Subscriber-level access or higher to inject executable script via their nickname/display_name. The vulnerability triggers when logged-out visitors load the attacker's author archive page.
The Booking for Appointments and Events Calendar – Amelia WordPress plugin contains an authorization bypass vulnerability in all versions from 9.0 through 9.9.1. Authenticated users with custom-level access or higher can export complete booking records for any event on the site without proper authorization checks. The exposed data includes attendee personal details and payment information.
The wpForo Forum plugin for WordPress contains a time-based SQL Injection vulnerability in the 'href[locale]' parameter affecting all versions up to and including 3.2.2. This flaw allows unauthenticated attackers to inject additional SQL queries due to insufficient escaping and lack of proper query preparation. Exploitation requires a nonce that is publicly accessible to any visitor, meaning no authentication or prior interaction is needed.
The YML for Yandex Market WordPress plugin up to version 5.10.0 exposes the merchant's plaintext Yandex Market API key in a publicly accessible log file due to sensitive information being written to logs. This vulnerability allows unauthenticated attackers to obtain the API key if the plugin's logging option is enabled and a key is stored, potentially enabling unauthorized control over the merchant's marketplace catalogue, prices, and stock.
The wpForo Forum plugin for WordPress contains a path traversal vulnerability in the theme_delete function affecting all versions up to and including 3.2.2. Authenticated users with subscriber-level access or higher can exploit insufficient file path validation to delete arbitrary files on the server. This vulnerability can lead to remote code execution if critical files like wp-config.php are deleted. Exploitation requires a specific site configuration where an administrator has created a custom wpForo secondary usergroup with a blank WordPress role and the 'mth' (Manage Themes) capability. Attackers can self-register and manipulate the wpforo_secondary_groupids[] POST field to bypass role restrictions and gain theme management access as a Subscriber.
The Zephyr Project Manager plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'zpm_profile_picture' parameter affecting all versions up to 3.3.209. Authenticated users with subscriber-level access or higher can inject malicious scripts into their own profile, which execute in an administrator's browser when the autocomplete mention lookup renders the avatar. Exploitation requires an administrator to view the injected content, as the attacker cannot trigger the vulnerability independently.
CVE-2026-123464 is a stored cross-site scripting (XSS) vulnerability in The Events Calendar plugin by Liquid Web / StellarWP. The flaw allows improper neutralization of input during web page generation, affecting versions from initial releases up to 6.18.3. A fix is available in version 6.18.3.1.
CVE-2026-119502 is a Missing Authorization vulnerability in BdThemes Ultimate Store Kit Elementor Addons versions prior to 4.0.2. This flaw allows unauthorized access due to incorrectly configured access control security levels. The issue has been fixed in version 4.0.2.
CVE-2026-122668 is a missing authorization vulnerability in the myCred plugin affecting versions prior to 4.0.3. It allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions. The issue is fixed in version 4.0.3.
CVE-2026-120853 is a missing authorization vulnerability in Brainstorm Force CartFlows versions prior to 3.3.1. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a medium severity rating with a CVSS score of 5.3. A fix is available in version 3.3.1.
CVE-2026-120852 is a medium severity vulnerability in Brainstorm Force's CartFlows plugin that allows code injection via improper neutralization of script-related HTML tags, resulting in a basic cross-site scripting (XSS) flaw. This affects CartFlows versions from initial releases up to 3.3.0. The vulnerability has been fixed in version 3.3.1.
CVE-2026-123469 is a medium severity vulnerability in The Events Calendar plugin by Liquid Web / StellarWP. It involves improper neutralization of script-related HTML tags, leading to a basic cross-site scripting (XSS) issue that allows code injection. Versions from initial releases up to 6.18.3 are affected. The vulnerability has been fixed in version 6.18.3.1.
CVE-2026-119491 is a missing authorization vulnerability in David Lingren's Media LIbrary Assistant affecting versions prior to 3.44. The flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionality. The issue has a medium severity rating with a CVSS score of 4.3 and is fixed in version 3.44.
CVE-2026-61990 is a missing authorization vulnerability in WC Lovers WCFM Membership plugin versions before 2.12.1. It allows exploitation due to incorrectly configured access control security levels, potentially leading to unauthorized actions. The issue is fixed in version 2.12.1.
CVE-2026-119484 is a Cross-Site Request Forgery (CSRF) vulnerability in the Photo Gallery by Supsystic plugin affecting versions before 1.21.7. This flaw allows an attacker to trick authenticated users into performing unwanted actions. The vulnerability is fixed in version 1.21.7.
CVE-2026-120847 is a missing authorization vulnerability in the Wpmet Metform plugin affecting versions prior to 4.3.4. This flaw allows attackers with limited privileges to exploit incorrectly configured access control, potentially leading to unauthorized modification of data. The issue has a medium severity rating and was fixed in version 4.3.4.
CVE-2026-119511 is a Missing Authorization vulnerability in the Saeed MC Woocommerce Wishlist plugin, versions prior to 2.0.4. It allows attackers to exploit incorrectly configured access control, potentially leading to unauthorized actions that impact the integrity of the system. The issue is fixed in version 2.0.4.
CVE-2026-121766 is a missing authorization vulnerability in Blubrry Podcasting PowerPress Podcasting affecting versions prior to 11.18.2. It allows exploitation due to incorrectly configured access control security levels, potentially leading to limited confidentiality and integrity impacts. The issue is fixed in version 11.18.2.
CVE-2026-123466 is a missing authorization vulnerability in LeapWorx Premium Blocks – Gutenberg Blocks for WordPress. It affects versions from the initial release up to 2.3.18. The flaw allows unauthorized access due to incorrectly configured access control security levels. A fix is available in version 2.3.19.
CVE-2026-121768 is a stored cross-site scripting (XSS) vulnerability in the Contact Form 7 – Post Fields plugin by Markus Wiesenhofer. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. This vulnerability affects versions from initial releases up to 2.7.0. A fix is available in version 2.7.1.