Farid Narimanov

The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email, phone, booking details and payment status by enumerating that identifier.

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9 does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markup, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor views the affected page.

The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that price, resulting in financial loss for the site owner.

🚨 CVE-2026-85038 The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a role selected during registration is one actually offered on the registration form, allowing unauthenticated users to assign themselves to restricted B2B customer groups and to skip the manual account-approval workflow during self-registration. 🎖@cveNotify

**Name of the Vulnerable Software and Affected Versions** Stripe Payment Forms by WP Full Pay versions prior to 8.5.5 **Description** An Insecure Direct Object Reference (IDOR) exists where the plugin fails to verify if a subscription belongs to the customer associated with the active customer-portal session before processing a cancellation. This allows an authenticated user with a valid portal session to cancel subscriptions belonging to other customers, provided they know the specific subscription identifier. This identifier is high-entropy, meaning it is a complex string that is difficult to guess or enumerate. **Recommendations** Update Stripe Payment Forms by WP Full Pay to version 8.5.5 or later.

**Name of the Vulnerable Software and Affected Versions** WP OAuth Server ( Login with WordPress ) versions prior to 6.3.1 **Description** When debug logging is enabled, the plugin fails to restrict access to its debug log. Because the log is stored at a fixed and publicly reachable location, unauthenticated users can read sensitive information, including issued OAuth tokens, authorization codes, and user records containing password hashes. **Recommendations** Update to version 6.3.1 or later. As a temporary mitigation, disable debug logging to prevent the creation of the publicly accessible log file.

**Name of the Vulnerable Software and Affected Versions** Masteriyo LMS versions prior to 2.3.3 **Description** The plugin fails to sanitize and escape a quiz field before outputting it on a page. This allows users with the instructor role to store unfiltered HTML, enabling Stored Cross-Site Scripting (XSS) attacks—a technique where malicious scripts are permanently stored on the server and executed in the browser of any visitor, including administrators. This issue affects default single-site installations; however, multisite installations or sites that define `DISALLOW UNFILTERED HTML` are not affected. **Recommendations** Update Masteriyo LMS to version 2.3.3 or later.

**Name of the Vulnerable Software and Affected Versions** Extra Product Options Builder for WooCommerce versions prior to 1.2.176 **Description** An issue exists where the plugin fails to verify if a requester is authorized to access a customer-uploaded file before serving it. This allows unauthenticated users to retrieve files if they obtain the stored file name. The exploitation of this issue depends on the web server configuration; it affects servers that honor deny-all rules in upload directories, such as Apache. On servers where such rules are ignored, like default nginx setups, files are already accessible via their direct URL, and the `getpublicfileupload` endpoint provides no additional exposure. **Recommendations** Update Extra Product Options Builder for WooCommerce to version 1.2.176 or later.

**Name of the Vulnerable Software and Affected Versions** Visualizer versions prior to 4.0.7 **Description** Insufficient authorization in the plugin allows users with the Contributor role and above to read the full configuration of any chart on the site. This includes charts that the interface normally restricts and allows the retrieval of all chart configurations in a single request. The exposed configuration may contain credentials for remote data sources used by the charts. **Recommendations** Update to version 4.0.7 or later.

**Name of the Vulnerable Software and Affected Versions** Simple JWT Login versions prior to 3.6.8 **Description** The plugin fails to validate the audience of accepted Google identity tokens. This allows unauthenticated users to authenticate as any user, including administrators, by providing a token containing the target user's email address. **Recommendations** Update Simple JWT Login to version 3.6.8 or later.

**Name of the Vulnerable Software and Affected Versions** Premium Packages versions prior to 7.0.7 **Description** An issue exists where withdrawal requests are not validated against the requesting user's actual earned balance. This allows any authenticated user, including those with the subscriber role and no sales history, to submit a payout request for an arbitrary amount. If an administrator approves the request, the funds may be paid out. **Recommendations** Update Premium Packages to version 7.0.7 or later.

**Name of the Vulnerable Software and Affected Versions** WP Helper Premium versions prior to 4.7.6 **Description** Insufficient verification of the order key occurs when rendering the custom order confirmation page or handling related AJAX actions. This allows unauthenticated users to view personal information and order details of other customers, as well as modify the state of arbitrary orders. This issue requires WooCommerce to be active and the optional order confirmation page module of the plugin to be enabled. **Recommendations** Update WP Helper Premium to version 4.7.6 or later. As a temporary mitigation, disable the optional order confirmation page module.

**Name of the Vulnerable Software and Affected Versions** ShopEngine Elementor WooCommerce Builder Addon versions prior to 4.9.3 **Description** An authentication endpoint is not protected against Cross-Site Request Forgery (CSRF), a type of attack that forces an authenticated user to execute unwanted actions on a web application. This flaw allows an attacker to log a victim into an account controlled by the attacker. Consequently, any billing and shipping details the victim enters during the checkout process are stored under and can be read by the attacker. **Recommendations** Update ShopEngine Elementor WooCommerce Builder Addon to version 4.9.3 or later.

**Name of the Vulnerable Software and Affected Versions** User Access Manager versions prior to 2.3.15 **Description** The User Access Manager WordPress plugin fails to apply access restrictions to REST API requests. This allows unauthenticated attackers to read the content of posts, pages, and custom post types that were intended to be restricted to specific user groups. **Recommendations** Update User Access Manager to version 2.3.15 or later.

**Name of the Vulnerable Software and Affected Versions** WP Photo Album Plus versions prior to 9.2.09.002 **Description** An authorization flaw exists when processing front-end uploads, where the system fails to verify if the current user has permission to upload to the target album. This allows any authenticated user, including those with Subscriber roles, to upload files into albums owned by other users or the administrator. This issue is only exploitable if the front-end user upload feature is enabled. **Recommendations** Update to version 9.2.09.002 or later. Disable the front-end user upload feature to mitigate the risk.

**Name of the Vulnerable Software and Affected Versions** WPC Admin Columns versions prior to 2.3.4 **Description** The WPC Admin Columns WordPress plugin lacks authorization checks in an AJAX action. This allows users with roles as low as subscriber to read arbitrary user, post, and term metadata, which may include sensitive information belonging to administrators. **Recommendations** Update WPC Admin Columns to version 2.3.4 or later.

**Name of the Vulnerable Software and Affected Versions** Contact Form to Any API versions prior to 3.0.7 **Description** The plugin fails to use random filenames when copying files uploaded via contact forms into a publicly accessible directory. This allows unauthenticated attackers to enumerate and download files submitted by other users. **Recommendations** Update to version 3.0.7 or later.

**Name of the Vulnerable Software and Affected Versions** Product Input Fields for WooCommerce versions prior to 2.0.2 **Description** An issue exists where the plugin fails to validate uploaded file types when the `accepted-types` setting is left empty. This configuration, which is advertised in the documentation as a way to accept all files, allows unauthenticated attackers to upload arbitrary files. This can lead to remote code execution on servers that do not enforce directory access rules. **Recommendations** Update Product Input Fields for WooCommerce to version 2.0.2 or later. Avoid leaving the `accepted-types` setting empty to prevent the upload of arbitrary files.

**Name of the Vulnerable Software and Affected Versions** Block User Account versions prior to 2.0.1 **Description** The plugin fails to enforce account blocks across all authentication paths. This allows a blocked user who possesses an application password created before the block was applied to maintain full role-level read and write access via the REST API. **Recommendations** Update to version 2.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** RSS Aggregator by Feedzy versions prior to 5.2.6 **Description** The plugin fails to verify if the requesting user owns or has permission to edit the specified import job. This allows users with author-level access or higher to permanently delete posts created by another user's import job, disable the job, clear its error log, or reset its scheduling and deduplication state. Additionally, due to a lack of object-type checks in one of the affected actions, arbitrary posts and pages can be unpublished regardless of ownership. **Recommendations** Update RSS Aggregator by Feedzy to version 5.2.6 or later.