CVE Notifier

CVE-2026-85530 CWE-? N/A

GiveWP < 4.16.8.1 - Unauthenticated Account Takeover via Donor Email Sanitization Mismatch

The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthenticated users to be re…

WPScan Unknown:GiveWP 16 Sep 2026

CVE-2026-85349 CWE-? N/A

FluentBoards < 2.0.15 - Subscriber+ Private Board Membership Disclosure via IDOR

The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authenticated user, including a Subscriber with no board access, t…

WPScan Unknown:FluentBoards 16 Sep 2026

CVE-2026-85131 CWE-? N/A

WPLP Cookie Consent < 4.4.4 - Arbitrary Post Deletion via CSRF

The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items to its own records, a…

WPScan Unknown:WPLP · Cookie · Consent 16 Sep 2026

CVE-2026-84907 CWE-? N/A

Eventin < 4.1.24 - Unauthenticated Order and Attendee Status Reset via Payment REST Endpoint

The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline (local) payment method is enabled, relying on a nonce that is exposed to unauthenticated visitors and never chec…

WPScan Unknown:Eventin 16 Sep 2026

CVE-2026-84905 CWE-? N/A

Eventin < 4.1.24 - Contributor+ User Creation via Speaker Creation

The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level access and above to create new WordPress user accounts that …

WPScan Unknown:Eventin 16 Sep 2026

CVE-2026-84829 CWE-? N/A

Optimole < 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor Parameter

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served…

WPScan Unknown:Optimole 16 Sep 2026

CVE-2026-84088 CWE-? N/A

Xpro Elementor Addons < 1.7.9 - Contributor+ Stored XSS via Interactive Circle Widget

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call, allowing users with the contribu…

WPScan Unknown:Xpro · Addons · — 16 Sep 2026

CVE-2026-82126 CWE-? N/A

Schema & Structured Data for WP & AMP 1.63 - 1.65 - Contributor+ Non-Public Post Content Disclosure via AI Schema Generation

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the specific post they request schema generation for, allowing users with the contributor role and abov…

WPScan Unknown:Schema · & · Structured 16 Sep 2026

CVE-2026-82125 CWE-? N/A

Schema & Structured Data for WP & AMP 1.46 - 1.65 - Unauthenticated Non-Public Comment Content Disclosure via IDOR

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not correctly verify the ownership or the moderation status of a comment before returning its content, allowing unauthenticated users to read th…

WPScan Unknown:Schema · & · Structured 16 Sep 2026

CVE-2026-82124 CWE-? N/A

Schema & Structured Data for WP & AMP < 1.66 - Unauthenticated Password-Protected Post Content Disclosure via JSON-LD Schema Output

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users …

WPScan Unknown:Schema · & · Structured 16 Sep 2026

CVE-2026-78474 CWE-? N/A

Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated Order and Customer Data Disclosure via 'btn_print' Parameter

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any authentication or authorisation checks on one of its report-printing routines, allowing unauthenticated users to retrieve WooCommerce order…

WPScan Unknown:Ni · WooCommerce · Sales 16 Sep 2026

CVE-2026-78472 CWE-? N/A

Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated SQLi via 'sort' Parameter

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.

WPScan Unknown:Ni · WooCommerce · Sales 16 Sep 2026