CVE Notifier

CVE-2026-15275 CWE-89 7.5

WP Multi Store Locator Pro <= 4.5.1 - Unauthenticated SQL Injection via 'store_locator_search_radius' Parameter

The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the 'store_locatore_search_radius' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the …

Wordfence wpexpertsio:WP · Multi · Store 2 hari lalu

CVE-2026-12739 CWE-862 4.3

WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. This is due to the plugin not properly verifying that…

Wordfence saadiqbal:WP · Easy · Pay 2 hari lalu

CVE-2026-16777 CWE-22 4.9

Store Exporter <= 2.8.0 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read and Arbitrary File Deletion via 'filename' Parameter

The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.0 via the 'filename' parameter parame…

Wordfence jkohlbach:Store · Exporter · – 2 hari lalu

CVE-2026-15004 CWE-79 5.4

FileBird – WordPress Media Library Folders & File Manager <= 6.5.6 - Authenticated (Author+) Stored Cross-Site Scripting

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 6.5.6 due to insufficient input san…

Wordfence ninjateam:FileBird · – · WordPress 2 hari lalu

CVE-2026-14472 CWE-79 6.4

Kubio AI Page Builder <= 2.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block Content

The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kubio/copyright Block Content in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output …

Wordfence extendthemes:Kubio · AI · Page 2 hari lalu

CVE-2026-12954 CWE-20 8.8

Mapster WP Maps <= 1.23.0 - Authenticated (Subscriber+) Arbitrary User Meta Write via 'acf-photo-gallery-groups' Parameter

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the `my_profile_update()` function. This is due to the function performing no nonce ver…

Wordfence mapster:Mapster · WP · Maps 2 hari lalu

CVE-2026-75961 CWE-89 4.9

NEX-Forms <= 9.3.0 - Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additional_params' parameter in all versions up to, and including, 9.3.0 due to insufficient escapi…

Wordfence webaways:NEX-Forms · – · Ultimate 2 hari lalu

CVE-2026-14323 CWE-22 7.5

Printcart Web to Print Product Designer for WooCommerce <= 2.8.5 - Unauthenticated Arbitrary File Read via 'folder' and 'mockups' Parameters

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.5 via the 'mockups' parameter. This makes it possible for un…

Wordfence printcart:Printcart · Store · – 2 hari lalu

CVE-2026-92622 CWE-79 6.4

Strong Testimonials <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute in all versions up to, and including, 3.3.8 due to insufficient input sanitization and ou…

Wordfence wpchill:Strong · Testimonials 2 hari lalu

CVE-2026-90981 CWE-79 6.1

Newsletter <= 9.3.8 - Reflected Cross-Site Scripting via 'nn' Parameter

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nn' parameter in all versions up to, and including, 9.3.8 due to insufficient input saniti…

Wordfence satollo:Newsletter · – · Send 2 hari lalu

CVE-2026-13471 CWE-639 4.3

LatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via the LatePointAbilityDeleteBooking…

Wordfence latepoint:Appointment · Booking · Plugin 2 hari lalu

CVE-2026-92554 CWE-79 6.1

ShopLentor <= 3.5.1 - Reflected Cross-Site Scripting via Query-String Parameter Name

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all versions up to, and including, 3.5.1 d…

Wordfence devitemsllc:ShopLentor · – · All-in-One 2 hari lalu