Threat database

SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpsp_el_editor_form AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or reschedule administrator posts, or publish other users' pending or draft posts.

Incorrect Privilege Assignment vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Privilege Escalation.This issue affects Essential Addons for Elementor: from n/a through 6.8.5.

The WP CV Builder plugin for WordPress has a vulnerability allowing unauthenticated attackers to upload arbitrary PNG files due to missing authorization checks in the 'wp_save_signature_image' function. This affects all versions up to and including 1.3.1. The vulnerability can lead to unauthorized file uploads to the WordPress uploads directory.

The Booking Calendar plugin for WordPress contains a vulnerability in versions up to and including 11.4.3 that allows unauthenticated attackers to access sensitive customer information. This exposure occurs via the wpbc_is_show_popover_in_flex_timeline() function and can leak names, email addresses, and phone numbers of customers who have made bookings. The vulnerability has a medium severity rating with a CVSS score of 5.3.

CVE-2026-39601 is a race condition vulnerability in the WPdevelop Booking Calendar plugin affecting versions prior to 11.9. It involves improper synchronization during concurrent execution of shared resources, which can lead to integrity issues. The vulnerability has a low CVSS score of 3.7 and does not impact confidentiality or availability, only integrity to a limited extent.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 6.8.4.

The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpbc_auto_fill' parameter in all versions up to, and including, 11.8.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to, and including, 11.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The nonce check is bypassed by default because the 'booking_is_nonce_at_front_end' option ships disabled, allowing unauthenticated requests to reach the vulnerable sink without any verification.

The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 11.8.2 via the `wpbc_ajax_option_save` AJAX action. The vulnerability exists because the `handle_ajax_save()` function applies per-option safeguards only to names explicitly registered via `register_option_policy()`, causing `get_option_policy()` to return an empty policy — bypassing all can_save, force_mode, and allowed_keys checks — for any unregistered option name, including core WordPress options, while an attacker-controlled `data_name` parameter passes through `sanitize_key()` and is written directly to `update_option()` without restriction. This makes it possible for authenticated attackers with Editor-level access and above to escalate their privileges to Administrator by writing core WordPress options such as `default_role=administrator` and `users_can_register=1`, then self-registering a new Administrator account. The nonce check does not meaningfully restrict this attack, as both the nonce value and nonce action are attacker-supplied POST parameters, and a valid nonce is trivially obtainable via `admin-ajax.php?action=rest-nonce`.

Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions.

CVE-2026-81777 is an authentication bypass vulnerability in WPDeveloper Essential Addons for Elementor that allows identity spoofing. It affects versions up to and including 6.8.0. The vulnerability is classified under CWE-290 (Authentication Bypass by Spoofing) and has a medium severity with a CVSS score of 5.3. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.

Contributor Cross Site Scripting (XSS) in Table Of Contents Block <= 1.5.0 versions.

CVE-2026-61961 is a high severity vulnerability in WPDeveloper's EmbedPress plugin, affecting versions up to and including 4.5.6. It is an unauthenticated Cross-Site Scripting (XSS) vulnerability, classified under CWE-79, which involves improper neutralization of input during web page generation. This vulnerability allows attackers to inject malicious scripts that can impact confidentiality, integrity, and availability with user interaction.

Contributor Cross Site Scripting (XSS) in BetterDocs <= 4.6.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Booking Calendar <= 11.4.2 versions.

Improper Validation of Specified Quantity in Input vulnerability in WPDeveloper Better Payment – Instant Payments, Donations, Fundraising with Subscriptions &amp; More better-payment allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Better Payment – Instant Payments, Donations, Fundraising with Subscriptions &amp; More: from n/a through <= 2.2.0.

EmbedPress versions up to and including 4.5.2 contain an unauthenticated sensitive data exposure vulnerability. This issue is due to an authorization bypass through a user-controlled key, classified under CWE-639. The vulnerability allows an attacker to access sensitive data without authentication.