CVE-2026-73243

kkFileView: Unauthenticated SSRF via /addTask with fullfilename type-confusion bypass

kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkFileView is omitted from TrustHostFilter and TrustDirFilter in server/src/main/java/cn/keking/config/WebConfig.java, allowing FileConvertQueueTask to fetch an attacker-selected URL after FileHandlerService#getFileAttribute uses the fullfilename parameter to force an OFFICE, COMPRESS, or CAD type. This issue is fixed in version 5.0.1.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Keking

Products

Kkfileview

CVE-2026-16066

Welcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product Name

The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Welcart Wordpress

Products

Welcart E-commerce Wordpress

CVE-2026-16294

Blubrry PowerPress < 11.17.1 - Contributor+ Server-Side Request Forgery via Podcast Episode Chapters URL

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a server-side request with it, allowing users with a role as low as Contributor to perform Server-Side Request Forgery attacks that can target internal services.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Blubrry Wordpress

Products

Powerpress Podcasting Plugin By Blubrry Wordpress

CVE-2026-16737

WP Travel Engine < 6.8.5 - Unauthenticated Booking Details Disclosure and Modification via wte_add_trip_to_cart

The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored billing information, and to overwrite that customer's booking record with their own data.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wptravelengine

Products

Wordpress Wp Travel Engine

CVE-2026-17013

WP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstart

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted link to a page displaying one of its galleries.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wp Photo Album Plus Project

Products

Wordpress Wp Photo Album Plus

CVE-2026-18035

User Access Manager < 2.3.15 - Unauthenticated Restricted Content Disclosure via REST API

The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read the content of posts, pages and custom post types that have been restricted to specific user groups.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

User Access Manager Project Wordpress

Products

User Access Manager Wordpress

CVE-2026-18048

WP Photo Album Plus < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server, including ones stored outside the web root.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wp Photo Album Plus Project

Products

Wordpress Wp Photo Album Plus

CVE-2026-18049

WP Photo Album Plus < 9.2.07.002 - Unauthenticated Option Disclosure via gettogo

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of other autoloaded options whose names end in a matching suffix.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wp Photo Album Plus Project

Products

Wordpress Wp Photo Album Plus

CVE-2026-18057

Events Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL Injection

The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Events Manager Project Wordpress

Products

Events Manager Wordpress

CVE-2026-18230

WP Directory Kit < 1.5.6 - Subscriber+ SQL Injection via section Parameter

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpdirectorykit

Products

Wordpress Wp Directory Kit

CVE-2026-18366

Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator

The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the Events Manager WordPress plugin before 7.4.1's own posts.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Events Manager Project Wordpress

Products

Events Manager Wordpress

CVE-2026-18391

WooCommerce Subscriptions < 9.1.0 - Unauthenticated RCE via PHP Object Injection

The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Woocommerce Wordpress

Products

Subscriptions Wordpress

CVE-2026-18474

WP Directory Kit < 1.5.6 - Unauthenticated SQL Injection via search_location and search_category

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpdirectorykit

Products

Wordpress Wp Directory Kit

CVE-2026-4901

Insertion of Sesitive Information into Log File in AlanWeb SCADA

AlanWeb SCADA saves sensitive information into a log file. Critically, user credentials are logged allowing the attacker to obtain further authorized access into the system. Combined with vulnerability CVE-2026-34184, these sensitive information could be accessed by an unauthorized user. This issue was fixed in AlanWeb SCADA version 9.8.5

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Control System Hydrosystem Hydrosystem.poznan

Products

Alanweb Scada Control System Control System

CVE-2026-34185

SQL Injection in AlanWeb SCADA

AlanWeb SCADA is vulnerable to SQL Injection across most scripts and input parameters. Because no protections are in place, an authenticated attacker can inject arbitrary SQL commands, potentially gaining full control over the database. This issue was fixed in AlanWeb SCADA version 9.8.5

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Control System Hydrosystem Hydrosystem.poznan

Products

Alanweb Scada Control System Control System

CVE-2026-34184

Missing Authorization inAlanWeb SCADA

AlanWeb SCADA does not enforce authorization for some directories. This allows an unauthorized attacker to read all files in these directories and even execute some of them. Critically the attacker could run PHP scripts directly on the connected database. This issue was fixed in AlanWeb SCADA version 9.8.5

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Control System Hydrosystem Hydrosystem.poznan

Products

Alanweb Scada Control System Control System

CVE-2026-66151

Out-of-Bounds Read in SonicWall Global VPN Client SWIPsec.sys Leads to System Crash

SonicWall Global VPN Client version 4.10.8.1108 and earlier is vulnerable to an out-of-bounds kernel memory read in the SWIPsec.sys driver, which could allow a local attacker to cause a system crash.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Sonicwall

Products

Global Vpn Client

CVE-2026-16574

Dokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.11 does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST endpoints, allowing an authenticated vendor to grant their own customer free download access to another vendor's paid downloadable files.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Dokan Wordpress

Products

Ai Powered Woocommerce Multivendor Marketplace Solution:dokan: Ai Powered Woocommerce Multivendor Marketplace Solution Wordpress

CVE-2026-16608

Download Monitor < 5.2.6 - Unauthenticated Download Log Injection

The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Download Monitor Wordpress

Products

Download Monitor Wordpress

CVE-2026-16948

Solace Extra < 1.6.1 - Subscriber+ Multiple Missing Authorization via Site-Wide Nonce Exposure

The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and delete imported site-builder content.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Solacewp Wordpress

Products

Solace Extra Wordpress