CVE-2026-125437 is a missing authorization vulnerability in NSquared Simply Schedule Appointments affecting versions prior to 1.6.13.4. The flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized access to certain functions. The issue has a medium severity with a CVSS score of 5.3 and is fixed in version 1.6.13.4.
CVE-2026-121028 is a medium severity vulnerability in the WP Chill Strong Testimonials plugin that allows code injection via improper neutralization of script-related HTML tags, resulting in a basic cross-site scripting (XSS) flaw. This affects versions from initial release up to 3.3.17. The issue is fixed in version 3.3.18.
CVE-2026-125761 is a stored cross-site scripting (XSS) vulnerability in YITH WooCommerce Ajax Search versions prior to 2.30.1. The flaw involves improper neutralization of input during web page generation, allowing attackers with low privileges and requiring user interaction to inject malicious scripts. This vulnerability has a medium severity rating with a CVSS score of 6.5. A fix is available in version 2.30.1.
CVE-2026-121770 is a Cross-Site Request Forgery (CSRF) vulnerability in the VillaTheme VISeek plugin, versions up to 1.0.5. This vulnerability allows an attacker to induce a user to perform unwanted actions on a web application in which they are authenticated. The issue is fixed in version 1.0.6.
CVE-2026-121014 is a missing authorization vulnerability in the Ahmad WP Job Portal plugin for WordPress, affecting versions prior to 2.8.0. This flaw allows unauthorized users to exploit incorrectly configured access control, potentially leading to unauthorized information disclosure. The vulnerability has a medium severity with a CVSS score of 5.3. A fix is available in version 2.8.0.
CVE-2026-124408 is a missing authorization vulnerability in the Arraytics WPCafe plugin for WordPress, affecting versions prior to 3.0.23. This flaw allows attackers with low privileges to exploit incorrectly configured access control, potentially leading to limited confidentiality and integrity impacts. The vulnerability has a medium severity rating and is fixed in version 3.0.23.
CVE-2026-123473 is a stored cross-site scripting (XSS) vulnerability in the Happy Addons for Elementor plugin by weDevs. It affects versions from initial releases up to 3.51.0. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers with low privileges to execute malicious scripts. The issue is fixed in version 3.51.3.
CVE-2026-121773 is a stored cross-site scripting (XSS) vulnerability in GenerateBlocks, a plugin for GeneratePress. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers with limited privileges to inject malicious scripts. This vulnerability affects GenerateBlocks versions from initial releases up to 2.5.0. A fix is available in version 2.5.1.
CVE-2026-124752 is a stored cross-site scripting (XSS) vulnerability in BdThemes Element Pack Elementor Addons versions prior to 10.0.4. It allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges and user interaction to execute malicious scripts. The vulnerability is fixed in version 10.0.4.
CVE-2026-125438 is a missing authorization vulnerability in Webful Creations RepairBuddy, a computer repair shop management software. The flaw allows unauthorized access due to incorrectly configured access control security levels. It affects versions from initial releases up to 4.1235. A fix is available in version 4.1236. The vulnerability has a CVSS score of 5.3, indicating medium severity, with impact limited to confidentiality loss without integrity or availability impact.
CVE-2026-125434 is a missing authorization vulnerability in Webful Creations RepairBuddy, a computer repair shop management software. The flaw allows exploitation of incorrectly configured access control security levels in versions prior to 4.1236. This could lead to unauthorized actions impacting the integrity and availability of the system. The vulnerability has a medium severity score of 5.4 and has been fixed in version 4.1236.
Insertion of Sensitive Information Into Sent Data vulnerability in Cozmoslabs Profile Builder profile-builder allows Retrieve Embedded Sensitive Data.This issue affects Profile Builder: from n/a through 4.0.6.
CVE-2026-125439 is a Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) affecting versions prior to 3.5.1. This flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized access to certain functions or data. The vulnerability has a medium severity with a CVSS score of 5.3. A fix is available in version 3.5.1.
CVE-2026-124413 is a missing authorization vulnerability in WP User Manager versions prior to 2.10.5. It allows unauthorized users to exploit incorrectly configured access control security levels. The issue affects all versions from initial release up to 2.10.4 and has been fixed in version 2.10.5.
CVE-2026-125455 is a stored cross-site scripting (XSS) vulnerability in Bold Themes' Bold Page Builder plugin. It affects versions from initial releases up to 5.9.11. The vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. A fix is available in version 5.9.12.
CVE-2026-125451 is a stored cross-site scripting (XSS) vulnerability in bPlugins B Blocks affecting versions prior to 2.1.16. The flaw allows improper neutralization of input during web page generation, which can lead to script injection. This vulnerability has a CVSS score of 6.5, indicating a medium severity level. A fix is available in version 2.1.16.
CVE-2026-115600 is a missing authorization vulnerability in the DEV Institute Restrict User Access – Membership Plugin with Force. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access. The issue affects versions from initial releases up to 2.8.3. A fix is available in version 2.8.4. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity, with network attack vector and no privileges or user interaction required.
CVE-2026-125784 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Magnigenie RestroPress versions prior to 3.5.0. This flaw allows an attacker to trick authenticated users into performing unwanted actions on the application. The vulnerability is rated high severity with a CVSS score of 8.8, indicating significant potential impact on confidentiality, integrity, and availability. A fix is available in version 3.5.0.
CVE-2026-122671 is a missing authorization vulnerability in the E2Pdf.com e2pdf plugin affecting versions prior to 2.00.00. The flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized access to sensitive data. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact primarily on confidentiality. A fix is available in version 2.00.00.