Usama Arshad

The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actions, allowing any authenticated user such as a subscriber to overwrite private notes on records belonging to other users.

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9, the live redemption code, which anyone holding it can spend. Versions from 3.0.3 to 3.2.8 disclose the same data without the redemption code.

🚨 CVE-2026-81423 The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect visitors to an arbitrary external website, which can be leveraged for phishing. 🎖@cveNotify

The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach files to, any listing owned by another user.

**Name of the Vulnerable Software and Affected Versions** Rank Math SEO WordPress plugin versions prior to 1.0.277 **Description** Insufficient verification of metadata ownership allows users with the Author role and above to overwrite arbitrary post and user metadata. This flaw enables the modification of data belonging to higher-privileged users. **Recommendations** Update Rank Math SEO WordPress plugin to version 1.0.277 or later.

**Name of the Vulnerable Software and Affected Versions** WC Vendors versions prior to 2.7.2.1 **Description** An Insecure Direct Object Reference (IDOR) exists when saving product variations. The software fails to verify the object type or ownership of user-supplied IDs, which allows authenticated users with the vendor role to modify product variations belonging to other vendors. Additionally, this flaw enables the modification of the status and title of arbitrary posts. **Recommendations** Update WC Vendors to version 2.7.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** WC Vendors versions prior to 2.7.2.1 **Description** Certain front-end order shipment status actions lack Cross-Site Request Forgery (CSRF) protection. CSRF is a type of attack that tricks a logged-in user into executing unwanted actions on a web application. This flaw allows attackers to force a logged-in vendor to change the shipment status of their own orders by using a specially crafted request. **Recommendations** Update WC Vendors to version 2.7.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** Project Manager versions 2.2.0 through 4.0.6 **Description** An Insecure Direct Object Reference (IDOR) exists in a REST API route where the plugin fails to verify if the authenticated user requesting activity data is the owner of that data. This allows any authenticated user, including those with subscriber-level privileges, to access the activity history of other users, exposing their email addresses and details of projects they are not authorized to view. **Recommendations** Update Project Manager to version 4.0.7 or later.

**Name of the Vulnerable Software and Affected Versions** Project Manager WordPress plugin versions prior to 4.0.7 **Description** Lack of authorization checks on import routes allows unauthenticated users to create WordPress accounts using passwords known to the attacker. This process bypasses the registration settings configured on the site. **Recommendations** Update the Project Manager WordPress plugin to version 4.0.7 or later.

**Name of the Vulnerable Software and Affected Versions** Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin versions prior to 5.0.14 **Description** An unauthenticated store REST endpoint fails to restrict access to per-vendor commission configurations. This allows any unauthenticated user to disclose a vendor's commission type and, in cases where category-based commission is configured, the default and per-category commission rates. **Recommendations** Update the plugin to version 5.0.14 or later.

**Name of the Vulnerable Software and Affected Versions** WP Travel Engine versions prior to 6.8.5 **Description** The plugin fails to perform authorization or ownership checks when loading a booking identifier provided by the user in an unauthenticated cart action. This allows unauthenticated attackers to disclose booking order details and stored billing information of any customer. Additionally, attackers can overwrite a customer's booking record with their own data via the `wte add trip to cart` action. **Recommendations** Update WP Travel Engine to version 6.8.5 or later.

**Name of the Vulnerable Software and Affected Versions** Ezoic WordPress plugin versions prior to 2.23.1 **Description** Insufficient access restrictions in the content export functionality allow unauthenticated attackers to trigger a server-side export of the site database. This exposure includes sensitive data such as user password hashes and password reset tokens. Additionally, attackers can persistently modify certain plugin settings. **Recommendations** Update the Ezoic WordPress plugin to version 2.23.1 or later.

**Name of the Vulnerable Software and Affected Versions** CheckView versions prior to 2.3.2 **Description** The plugin fails to restrict its REST API authentication filter to its own routes. It unconditionally discards authentication errors for any request where the URI contains a specific string related to the plugin. This allows unauthenticated attackers to bypass the REST nonce check—a security token used to prevent Cross-Site Request Forgery (CSRF)—and execute any REST action available to a logged-in administrator, including the creation of a new administrator account, by tricking an administrator into clicking a crafted link. **Recommendations** Update CheckView to version 2.3.2 or later.

**Name of the Vulnerable Software and Affected Versions** Salon Booking System WordPress plugin versions prior to 10.30.34 **Description** The plugin fails to properly validate the ownership token of a booking during the confirmation steps of the booking-wizard. This allows unauthenticated attackers to access and disclose booking records of other customers, including personal information, by providing a sequential booking identifier. **Recommendations** Update the Salon Booking System WordPress plugin to version 10.30.34 or later.

**Name of the Vulnerable Software and Affected Versions** GeoDirectory versions prior to 2.8.169 **Description** The GeoDirectory WordPress plugin fails to perform authorization checks when returning map marker data for a single requested listing. This allows unauthenticated users to disclose the title and exact geographic coordinates of non-public listings, such as those in pending or draft status, via the markers REST endpoint. **Recommendations** Update to version 2.8.169 or later.

**Name of the Vulnerable Software and Affected Versions** YMC Filter versions prior to 3.12.8 **Description** The plugin fails to sanitize and escape a layout builder setting before it is output on a public endpoint. Additionally, the software does not verify object ownership when the setting is saved. This allows users with the Contributor role or higher to perform a Stored Cross-Site Scripting (XSS) attack—where malicious scripts are permanently stored on the server—by injecting JavaScript that executes in the browser of any visitor viewing an affected filter. **Recommendations** Update YMC Filter to version 3.12.8 or later.

**Name of the Vulnerable Software and Affected Versions** MStore API versions prior to 4.21.0 **Description** The MStore API WordPress plugin fails to perform authorization or purchase-ownership checks on its REST product-review creation route. This allows an unauthenticated attacker to create WooCommerce product reviews by specifying a custom reviewer name, email, and star rating, even on stores configured to restrict reviews to verified owners. **Recommendations** Update MStore API to version 4.21.0 or later.

**Name of the Vulnerable Software and Affected Versions** Events Manager versions prior to 7.4 **Description** An authorization check is missing on a REST route that serves temporarily stored file uploads. This allows unauthenticated users to retrieve another user's in-progress upload if the temporary identifier is known. The identifier is high-entropy, disclosed only to the uploader, and the file is removed upon submission or via scheduled cleanup, meaning a cross-user read cannot be achieved by guessing alone. The affected endpoint is 'events-manager/v1/uploads'. **Recommendations** Update to version 7.4 or later.

**Name of the Vulnerable Software and Affected Versions** Interactive World Maps plugin for WordPress versions up to, and including, 2.4.14 **Description** The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The `search` (`s`) parameter is specifically vulnerable to this issue. **Recommendations** For versions up to, and including, 2.4.14, update to a version later than 2.4.14 to resolve the issue. As a temporary workaround, consider restricting access to the `search` (`s`) parameter in the affected plugin until a patch is available.