Shivamani Vastrala

🚨 CVE-2026-81348 The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory login. 🎖@cveNotify

🚨 CVE-2026-15247 The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account credentials. 🎖@cveNotify

The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users.

**Name of the Vulnerable Software and Affected Versions** GamiPress WordPress plugin versions prior to 7.9.9.6 **Description** The video watch-tracking functionality does not properly restrict access, enabling users with the Subscriber role to award configured gamification points, achievements, and ranks to any user, including administrators. Additionally, this allows users to accrue these rewards without limit. **Recommendations** Update GamiPress WordPress plugin to version 7.9.9.6 or later.

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that metadata on any post, including private and draft posts.

**Name of the Vulnerable Software and Affected Versions** Simple Newsletter Plugin versions prior to 4.3.3 **Description** An issue exists where the plugin fails to verify if the requester is the subscriber specified in a public request before displaying stored details. This allows unauthenticated users to disclose a subscriber's personally identifiable information (PII) and the `confirm key` used to authorize changes to their record via the Actions page. **Recommendations** Update Simple Newsletter Plugin to version 4.3.3 or later.

**Name of the Vulnerable Software and Affected Versions** YayCurrency WordPress plugin versions prior to 3.3.5 **Description** The plugin fails to perform capability or ownership checks on multiple multi-vendor integration handlers accessible to unauthenticated users. This allows remote attackers to access sensitive information, including store order totals, vendor earnings, balance ledgers, and withdrawal histories, by iterating through identifiers. **Recommendations** Update the plugin to version 3.3.5 or later.

**Name of the Vulnerable Software and Affected Versions** Manual Image Crop versions prior to 1.15 **Description** The plugin fails to perform capability checks or nonce verification on the authenticated AJAX action used to crop attachment images. Because the current guard allows any logged-in user, a user with subscriber-level privileges can provide an arbitrary attachment ID to overwrite the generated intermediate-size image, such as a thumbnail, and modify its stored metadata, regardless of the media owner. This leads to a cross-user integrity and defacement issue within the Media Library. Additionally, the lack of a nonce makes the action susceptible to Cross-Site Request Forgery (CSRF), a technique where an attacker tricks a victim into performing actions they did not intend to do. **Recommendations** Update to version 1.15 or later.

**Name of the Vulnerable Software and Affected Versions** Product Feed PRO for WooCommerce by AdTribes versions prior to 13.5.7 **Description** An authorization check is missing on a REST read route, which allows unauthenticated users to disclose the store's feed configuration, including rules, filters, and field mapping. Additionally, this issue enables the enumeration of the full product category taxonomy. **Recommendations** Update Product Feed PRO for WooCommerce by AdTribes to version 13.5.7 or later.

**Name of the Vulnerable Software and Affected Versions** ECS WordPress plugin versions prior to 4.3.8 **Description** Insufficient capability and object-ownership checks in Dynamic Repeater AJAX handlers allow a user with Contributor privileges to inject data-source bindings into any post, including those authored by administrators. Because the values are rendered into a widget's repeater output without proper sanitization, this can lead to the execution of arbitrary JavaScript in the session of any visitor or administrator viewing the affected page. The handlers are protected only by a capability-agnostic nonce that any user with `edit posts` permissions can obtain via the Elementor editor. **Recommendations** Update ECS WordPress plugin to version 4.3.8 or later.

**Name of the Vulnerable Software and Affected Versions** Cookie Consent WordPress plugin versions prior to 0.0.10 **Description** Insufficient capability checks on the 'consent-settings' REST routes allow any authenticated user, including those with subscriber-level privileges, to modify the plugin settings. Additionally, on sites utilizing the vendor's paid plan, authenticated users can read stored visitor consent logs. **Recommendations** Update Cookie Consent WordPress plugin to version 0.0.10 or later.

**Name of the Vulnerable Software and Affected Versions** Slim SEO versions prior to 4.9.11 **Description** A post-meta preview feature fails to restrict access to posts that the user is authorized to edit, verifying only read access. This allows users with the Contributor role to read arbitrary post meta of published posts they do not own, including password-protected posts and posts of non-public post types. This disclosure may include protected and private keys. **Recommendations** Update Slim SEO to version 4.9.11 or later.

**Name of the Vulnerable Software and Affected Versions** WP Statistics versions prior to 14.16.10 **Description** Insufficient capability checks in a set of dashboard analytics AJAX handlers allow authenticated users with Subscriber-level access and above to disclose sensitive site visitor analytics data. The system relies solely on a nonce, which is a unique token used to prevent cross-site request forgery, but since every authenticated user possesses one, it fails to restrict access based on user roles. **Recommendations** Update WP Statistics to version 14.16.10 or later.

**Name of the Vulnerable Software and Affected Versions** Templately versions prior to 3.7.1 **Description** An authorization check is missing in a request handler, which allows unauthenticated attackers to overwrite the stored cloud service connection of the administrator. This action disconnects the legitimate administrator and redirects the site's cloud template library to content controlled by the attacker. **Recommendations** Update Templately to version 3.7.1 or later.

**Name of the Vulnerable Software and Affected Versions** Payment Gateway for Redsys & WooCommerce Lite WordPress plugin versions prior to 7.0.2 **Description** The plugin fails to verify the authenticity of incoming payment-provider notifications for a specific payment method before marking orders as paid. This allows unauthenticated attackers to forge a payment-confirmation callback to complete orders without performing the actual payment. **Recommendations** Update the plugin to version 7.0.2 or later.

The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004.

**Name of the Vulnerable Software and Affected Versions** PeproDev WooCommerce Receipt Uploader versions prior to 2.8.1 **Description** An Insecure Direct Object Reference (IDOR) exists where the plugin fails to verify if a requested attachment belongs to the order associated with the provided access token. This allows unauthenticated attackers to forge a token and disclose image attachments, such as payment receipts uploaded by other customers. **Recommendations** Update PeproDev WooCommerce Receipt Uploader to version 2.8.1 or later.

The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 does not correctly validate requests to its optional IP-based login restriction feature, allowing the restriction to be bypassed so that unauthenticated requests from non-allowlisted IP addresses can reach and use the login form, defeating the access control the administrator configured.

**Name of the Vulnerable Software and Affected Versions** Payment Plugins for PayPal WooCommerce WordPress plugin versions prior to 2.0.20 **Description** Insufficient authorization checks on a REST endpoint allow unauthenticated users to bypass payments. **Recommendations** Update the plugin to version 2.0.20 or later.

**Name of the Vulnerable Software and Affected Versions** The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin versions prior to 3.0.8 **Description** The plugin fails to sanitize uploaded SVG files when the SVG upload feature is enabled. This allows authenticated users with upload capabilities (such as Author and above) to upload SVG files containing JavaScript. When these files are viewed, the script executes within the site context, resulting in Stored Cross-Site Scripting (XSS), a flaw where malicious scripts are permanently stored on the target server. **Recommendations** Update the plugin to version 3.0.8 or later. As a temporary mitigation, disable the SVG upload feature.