Threat Intelligence Database

CVE-2026-16265 is a vulnerability in the WP Maps WordPress plugin before version 4.9.7. It arises because the plugin does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches. This allows users with a Subscriber account to trigger uncontrolled recursion, which exhausts server resources and causes a Denial of Service (DoS).

CVE-2026-16263 is a path traversal vulnerability in the WP Maps WordPress plugin before version 4.9.7. It arises because the plugin does not perform a capability check in one of its AJAX actions and fails to properly validate user-controlled paths before including files. This allows users with a Subscriber account to include and execute arbitrary existing local PHP files on the server.

The Estatik Real Estate Plugin for WordPress before version 4.3.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in its OAuth social login flow. This flaw allows an unauthenticated attacker to log a victim into an attacker-controlled account without their consent. As a result, the victim's subsequent actions on the site are associated with the attacker's account, potentially exposing sensitive information to the attacker.

Ajax Search Lite WordPress plugin versions before 4.14.5 contain a vulnerability that allows deserialization of untrusted input. This flaw enables unauthenticated attackers to perform PHP Object Injection. If a suitable POP chain is available via another installed Ajax Search Lite plugin before 4.14.5, this vulnerability can lead to Remote Code Execution.

CVE-2026-16041 is a missing authorization vulnerability in the MStore API WordPress plugin before version 4.21.0. It allows unauthenticated attackers to create WooCommerce product reviews without verifying purchase ownership, bypassing intended restrictions on review submissions. This can result in fake reviews with attacker-controlled reviewer names, emails, and star ratings on affected stores.

The MStore API WordPress plugin before version 4.21.0 contains an authorization bypass vulnerability in its vendor-orders endpoint. This flaw allows any authenticated user, including those with minimal privileges such as Subscribers, to access all WooCommerce orders in the store. Consequently, attackers can read sensitive customer personal information associated with these orders.

The MStore API WordPress plugin before version 4.21.0 contains a missing authorization vulnerability. This flaw allows unauthenticated attackers to mark arbitrary orders as paid without verifying payment with the payment gateway. Exploiting this vulnerability could enable attackers to obtain goods or services without payment.

CVE-2026-16030 is an authentication vulnerability in the MStore API WordPress plugin versions before 4.21.0. The plugin fails to properly verify the cryptographic signature of tokens used for phone-based login. This flaw allows unauthenticated attackers who know a registered user's phone number to forge authentication tokens and take over that user's account, including accounts with administrator privileges.

CVE-2026-15386 is a cross-site scripting (XSS) vulnerability in the Meow Gallery WordPress plugin versions before 5.5.2. It occurs because the plugin does not properly escape an attachment's alt text before inserting it into a link attribute for linked galleries. This allows users with Author role or higher to inject JavaScript payloads that execute in the browsers of visitors viewing posts containing the affected galleries.

The Content Views WordPress plugin before version 4.5 contains a SQL injection vulnerability due to missing capability checks on an AJAX action and improper sanitization of user-supplied data. This flaw allows any authenticated user, including those with minimal privileges such as Subscribers, to perform SQL injection attacks.