CVE Notifier

CVE-2026-87966 CWE-? N/A

Easy Appointments 4.0 - 4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion via IDOR

The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a r…

WPScan Unknown:Easy · Appointments 3 hari lalu

CVE-2026-87965 CWE-? N/A

Easy Appointments < 4.0.2.2 - Unauthenticated Appointment Cancellation/Confirmation via Forgeable Email-Link Token

The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation action, deriving the token from a hardcoded source-embedded sal…

WPScan Unknown:Easy · Appointments 3 hari lalu

CVE-2026-87775 CWE-? N/A

Tz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQLi via tzwrs_update_cell

The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated att…

WPScan Unknown:Tz · Weekly · Radio 3 hari lalu

CVE-2026-87774 CWE-? N/A

Tz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQL Injection via week

The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated att…

WPScan Unknown:Tz · Weekly · Radio 3 hari lalu

CVE-2026-87771 CWE-? N/A

Product Question and Answer <= 1.1.0 - Unauthenticated SQL Injection via p_id and read

The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape parameters before using them in SQL queries on AJAX actions available to unauthenticated users, allowing unauthenticated attacke…

WPScan Unknown:Product · Question · and 3 hari lalu

CVE-2026-87770 CWE-? N/A

Price Drop Alert for WooCommerce <= 1.1 - Unauthenticated SQL Injection via product

The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using them in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated a…

WPScan Unknown:Price · Drop · Alert 3 hari lalu

CVE-2026-87767 CWE-? N/A

WP Shortcut Link <= 1.2.0 - Unauthenticated SQL Injection via url

The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter before using it in a SQL query on an AJAX action available to unauthenticated users, allowing unauthent…

WPScan Unknown:wp · shortcut · link 3 hari lalu

CVE-2026-85350 CWE-? N/A

UpsellWP < 2.2.10 - Unauthenticated Price Manipulation via Frequently Bought Together

The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought Together campaign belong to that campaign, allowing unauthenticated users to buy arbitrary products …

WPScan Unknown:UpsellWP 3 hari lalu

CVE-2026-85127 CWE-? N/A

VikBooking 1.8.8 - 1.8.14 - Unauthenticated Stored XSS via SVG Chat Attachment

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may attach to its live chat, nor sanitize their contents, allowing them to store activ…

WPScan Unknown:VikBooking · Hotel · Booking 3 hari lalu

CVE-2026-85123 CWE-? N/A

Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Registration Policy Bypass via Login Form Type Confusion

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to create WordPress acco…

WPScan Unknown:Easy · Form · Builder 3 hari lalu

CVE-2026-85122 CWE-? N/A

Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Stored XSS via Form Type Confusion

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to store arbitrary conte…

WPScan Unknown:Easy · Form · Builder 3 hari lalu

CVE-2026-85009 CWE-? N/A

RestroPress <= 3.4.6 - Unauthenticated Order Enumeration and Order Note Modification via Payment Recovery

The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders ar…

WPScan Unknown:RestroPress 3 hari lalu