CVE-2026-12801

Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' attributes in all versions up to, and including, 3.5.43 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Themefic Wordpress

Products

Ultimate Addons For Contact Form 7 Wordpress

CVE-2026-14364

TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid'

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to account takeover via improper password reset validation in all versions up to, and including, 1.2.3. This is due to the plugin not properly validating a user's identity before resetting their password. This makes it possible for unauthenticated attackers to reset the password of arbitrary user accounts, including administrators, and gain access to those accounts.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Themetechmount Wordpress

Products

Truebooker-appointment-booking Wordpress

CVE-2026-14205

WP Events Manager < 2.2.5 - Subscriber+ Payment Bypass via 'qty' Parameter

The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress Wp-eventmanager

Products

Wordpress Wp Event Manager

CVE-2026-14331

Subscribe2 < 10.46 - Reflected XSS via email Parameter

The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Subscribe2 Project Wordpress

Products

Subscribe2 Wordpress

CVE-2026-15214

Subscriptions for WooCommerce < 2.0.1 - Subscriber+ Subscription Detail Disclosure via IDOR

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another customer's subscription information (the subscribed product, status, and dates) by supplying that subscription's ID.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpswings

Products

Wordpress Subscriptions For Woocommerce

CVE-2026-15215

Subscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin Installation

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manager role (who lack Subscriptions for WooCommerce WordPress plugin before 2.0.1-management capabilities) to install and activate arbitrary Subscriptions for WooCommerce WordPress plugin before 2.0.1, resulting in remote code execution.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpswings

Products

Wordpress Subscriptions For Woocommerce

CVE-2026-15361

Content Views < 4.5 - Subscriber+ SQL Injection via preview_request

The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Contentviewspro Wordpress

Products

Content Views Wordpress

CVE-2026-16030

MStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone Authentication

The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including administrator accounts.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mstore Wordpress

Products

Mstore Api Wordpress

CVE-2026-16038

MStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment Gateways

The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services for free.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Mstore Wordpress

Products

Mstore Api Wordpress

CVE-2026-16039

MStore API < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR

The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mstore Wordpress

Products

Mstore Api Wordpress

CVE-2026-16041

MStore API < 4.21.0 - Unauthenticated Product Review Creation

The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Mstore Wordpress

Products

Mstore Api Wordpress

CVE-2026-49006

TLS credential leakage vulnerability in ZTE F689 product

By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to TLS transmission.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Zte

Products

F689

CVE-2026-15239

Simple CAPTCHA with Cloudflare Turnstile < 1.42.0 - Unauthenticated Turnstile Protection Bypass via Reusable Forminator Cache Key

The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value, allowing unauthenticated attackers to solve one challenge and then replay token-less form submissions for a short window, defeating the anti-abuse protection the plugin provides.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Simple Captcha Wordpress

Products

Simple Captcha With Cloudflare Turnstile Wordpress

CVE-2026-49007

Information leakage vulnerability in ZTE F689 product

By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web interface.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Zte

Products

F689

CVE-2026-66493

Joomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.3

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths for delete, copy and move actions lead to path traversal vulnerabilities.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Phoca

Products

Phoca Commander Extension For Joomla

CVE-2026-49008

Integrity‑check credential leakage vulnerability in an application function of ZTE F689 product

By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific application function on the device.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Zte

Products

F689

CVE-2026-66492

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action lead to path a traversal vulnerability.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Phoca

Products

Phoca Commander Extension For Joomla

CVE-2026-66491

Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3

Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function lead to an arbitrary file read vulnerability.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Phoca

Products

Phoca Commander Extension For Joomla

CVE-2026-18938

P11-kit: integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems

A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes. This leads to a memory corruption issue, specifically a heap out-of-bounds write, which can crash the p11-kit RPC parsing process, resulting in a Denial of Service (DoS). This vulnerability is only exploitable on 32 bit systems.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Hardened Images Hummingbird and 2 more

CVE-2026-66494

Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0

Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unauthenticated attacker can store malicious JavaScript in a Joomla site's database via a single HTTP request. When an administrator opens the SP Page Builder editor, the JavaScript executes in their browser automatically..

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Joomshaper.net

Products

Sp Page Builder Extension For Joomla