AM Wishlist <= 1.1.0 - Unauthenticated Option Overwrite via amwl_upload_file

The Woocommerce Wishlist WordPress plugin through 1.1.0 does not have authorisation and CSRF checks in one of its unauthenticated AJAX actions, allowing unauthenticated users to overwrite any site option with the URL of an uploaded image or an empty value, breaking the site (for example by changing its URL or active , or deactivating every Woocommerce Wishlist WordPress plugin through 1.1.0).

Mine CloudVod < 2.6.7 - Unauthenticated Paid Lesson Content Disclosure

The Mine CloudVod WordPress plugin before 2.6.7 does not check whether the requester is enrolled in a course, or authorised at all, before returning the course's full curriculum together with the raw content of every published lesson, allowing unauthenticated visitors to retrieve paid lesson content, such as direct video source URLs, and the passwords of password-protected lessons.

WPCOM Member < 1.8.3 - Unauthenticated Account Takeover via WeChat Login Code Brute-Force

The WPCOM Member WordPress plugin before 1.8.3 does not limit or bind attempts to verify WeChat login codes, allowing unauthenticated attackers to brute-force a code issued to another user and log in as that user, including administrators, when WeChat official-account keyword login is enabled.

Essential Real Estate 5.3.5 - Customer+ Email Relay Allowlist Poisoning

The Essential Real Estate WordPress plugin before 5.3.6 does not verify that the recipients it allows for its contact email action are legitimate, allowing users with the self-registered Customer role to add any address to that allowlist so that unauthenticated users can then send emails with attacker-controlled content to it through the site.

WooCommerce Vindi Pagamento <= 0.8.3 - Unauthenticated Stored XSS via 'code' Parameter

The WooCommerce Vindi Pagamento WordPress plugin through 0.8.3 does not perform any authorisation check when updating an order's shipment tracking code, and does not escape that code when displaying it on the order edit page, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators and shop managers who view an order paid through the gateway. The stored payload is only rendered on sites using WooCommerce's legacy (WordPress posts) order storage.

WP Remote Users Sync < 2.2.1 - Privilege Escalation to Administrator via 'create' and 'update' Sync Actions

The WP Remote Users Sync WordPress plugin before 2.2.1 does not restrict which account fields a synchronised site may set when it creates or updates users, allowing a site holding the shared synchronisation keys to assign the administrator role, modify any existing account and write arbitrary user metadata, bypassing the receiving site's role and metadata restrictions.

WP Remote Users Sync < 2.2.1 - Subscriber+ Activity Log Deletion

The WP Remote Users Sync WordPress plugin before 2.2.1 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete the WP Remote Users Sync WordPress plugin before 2.2.1's entire activity log.

AppPresser < 5.0.0 - Unauthenticated Plugin and Theme Version Disclosure

The AppPresser WordPress plugin before 5.0.0 does not restrict access to two of its REST API endpoints, allowing unauthenticated visitors to retrieve the installed versions of AppPresser, its add-ons, several third-party AppPresser WordPress plugin before 5.0.0 and its .

Contact Form 7 < 6.2.5 - Editor+ Sensitive User Data Disclosure via Form Default Values

The Contact Form 7 WordPress plugin before 6.2.5 does not restrict which user properties a form field's default value can be populated from, allowing users with the Editor role and above to obtain the password hash and sensitive user meta (such as two-factor secrets) of higher-privileged users, including administrators, who view and submit the form.

Advance Guest Post <= 1.9 - Unauthenticated Arbitrary Attachment Deletion

The Advance Guest Post WordPress plugin through 1.9 does not perform any authorization or ownership check when deleting media attachments, relying only on a nonce exposed to every site visitor, allowing unauthenticated users to permanently delete arbitrary Media Library attachments and their files.

Advance Guest Post <= 1.9 - Unauthenticated Arbitrary File Upload via featured_action

The Advance Guest Post WordPress plugin through 1.9 does not properly restrict or validate file uploads, authorizing an upload action with a nonce exposed to every front-end visitor and checking only a file's leading bytes, allowing unauthenticated users to upload arbitrary PHP files and execute code remotely. Successful exploitation additionally requires the target to run PHP 7.x; on PHP 8.0 and later the vulnerable code path raises a fatal error before the file is written.

Advance Guest Post <= 1.9 - Unauthenticated Arbitrary File Upload via gallery_action

The Advance Guest Post WordPress plugin through 1.9 does not properly validate uploaded files, relying on a case-sensitive and incomplete extension check that unauthenticated users can trivially bypass, allowing them to upload arbitrary files, including executable PHP variants, into a web-reachable directory, which can lead to remote code execution depending on the server configuration.

LetsRecover <= 1.2.0 - Unauthenticated SQL Injection

The LetsRecover WordPress plugin through 1.2.0 does not sanitize a user-supplied value that is used as a database column name in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to append SQL to the query and read arbitrary data from the database, which is then returned through a second unauthenticated action.

LearnPress Course Wishlist < 4.1.2 IDOR via render_button

LearnPress Course Wishlist Add-on before 4.1.2 contains an insecure direct object reference vulnerability that allows remote attackers to manipulate any user's course wishlist by supplying an arbitrary user_id parameter to the render_button callback instead of relying on the session identity. Attackers can exploit the publicly accessible load_content_via_ajax REST route, which only requires a public wp_rest nonce, to add or remove courses from any user's wishlist and determine whether a given course is wishlisted by iterating user_id and course_id values.

Insertion of sensitive information into sent data in the user endpoints in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' MFA shared secrets via the user API responses.

Insertion of sensitive information into sent data in the user list endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' API key secret hashes via the user list API response.

Improper access control in the administrative role assignment endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with only vault assignment management rights to escalate privileges and read vault entry passwords via a crafted role assignment request.

Improper access control in the autofill vault search in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with only view permission on a shared entry to obtain its password in clear text via a linked credential entry created in their private vault.

A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to gain access to other users' secure email accounts via crafted HTTP requests.

A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to execute unauthorized code or commands or cause a denial of service via specially crafted JSON-RPC requests.