CVE-2026-104732Published
Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler
cve-program ·
Vendor product: Advanced IP Blocker
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
695766 source statements · aliases may refer to the same vulnerabilityCVE-2026-103365Published
Online Scheduling and Appointment Booking System <= 28.4 - Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details
cve-program ·
Vendor product: Online Scheduling and Appointment Booking System – Bookly
CVE-2026-94589Published
Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Upload
cve-program ·
Vendor product: Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)
CVE-2026-103889Published
3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter
cve-program ·
Vendor product: 3D Product configurator for WooCommerce
CVE-2026-5727Published
Hello Plus <= 1.7.7 - Authenticated (Contributor+) Missing Authorization to Template Activation via hello_plus_set_as_entire_site
cve-program ·
Vendor product: Hello Plus
CVE-2026-103964Published
Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email
cve-program ·
Vendor product: Download Manager
CVE-2026-6723Published
Appointment Booking Calendar <= 1.6.11.11 - Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token
cve-program ·
Vendor product: Simply Schedule Appointments
CVE-2026-104724Published
FireBox <= 3.1.13 - Authenticated (Author+) SQL Injection via FireBox Form Display Condition
cve-program ·
Vendor product: FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment
CVE-2026-104021Published
Fastcache by Host.it <= 1.7.4 - Authenticated (Administrator+) Code Injection via .htaccess Directive Injection via 'cache_cookie_exclude' Setting
cve-program ·
Vendor product: Fastcache by Host.it
CVE-2026-97670Published
Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field
cve-program ·
Vendor product: Avada (Fusion) Builder
CVE-2026-89301Published
rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 - Missing Authorization to Unauthenticated Limited File Read/Disclosure and Limited File Deletion via Sideload via 'files[tmp_name]' Parameter
cve-program ·
Vendor product: rtMedia for WordPress, BuddyPress and bbPress
CVE-2026-91050Published
Appointment Booking Plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' Parameter
cve-program ·
Vendor product: Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
CVE-2026-18496Published
Booking Calendar <= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action
cve-program ·
Vendor product: Booking Calendar
CVE-2026-104023Published
Smart Popup by Supsystic <= 1.13.2 - Authenticated (Administrator+) SQL Injection via 'sidx' Parameter
cve-program ·
Vendor product: Smart Popup by Supsystic
CVE-2026-104741Published
AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Global Plugin Settings Modification via ajax_save_cpt_indexing_options AJAX Endpoint
cve-program ·
Vendor product: AI Puffer – AI Chatbot, AI Writer & Automation
CVE-2026-104766Published
Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter
cve-program ·
Vendor product: Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
CVE-2026-104742Published
AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Semantic Search Settings Modification via ajax_save_semantic_search_settings AJAX action
cve-program ·
Vendor product: AI Puffer – AI Chatbot, AI Writer & Automation
CVE-2026-104725Published
Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter
cve-program ·
Vendor product: Groundhogg — CRM, Newsletters, and Marketing Automation
CVE-2026-104763Published
Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_path' Parameter in media_metadata.json
cve-program ·
Vendor product: Post Export Import with Media
CVE-2026-94375Published
Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()
cve-program ·
Vendor product: Order Export & Order Import for WooCommerce
CVE-2026-77183Published
FooSales <= 1.43.0 - Authenticated (Custom+) Privilege Escalation via create_update_customer REST Endpoint
cve-program ·
Vendor product: FooSales – Point of Sale (POS) for WooCommerce
CVE-2026-104899Published
GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter
cve-program ·
Vendor product: GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
CVE-2026-92975Published
Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion
cve-program ·
Vendor product: Groundhogg — CRM, Newsletters, and Marketing Automation
CVE-2026-104723Published
LifterLMS <= 10.2.1 - Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data
cve-program ·
Vendor product: LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
CVE-2026-15178Published
Fluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification
cve-program ·
Vendor product: Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
CVE-2026-97348Published
SiteOrigin Widgets Bundle <= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode 'value' JSON Instance (design.colors LESS Variable)
cve-program ·
Vendor product: SiteOrigin Widgets Bundle
CVE-2026-12626Published
Online Scheduling and Appointment Booking System <= 28.2 - Authenticated (Custom+) PHP Object Injection via 'value' Parameter
cve-program ·
Vendor product: Online Scheduling and Appointment Booking System – Bookly
CVE-2026-104801Published
PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter
cve-program ·
Vendor product: PPOM – Product Addons & Custom Fields for WooCommerce
CVE-2026-94538Published
WP File Download <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via 'task' Parameter to Multiple Functions
cve-program ·
Vendor product: WP File Download
CVE-2026-107712Published
WP Booking System <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter
cve-program ·
Vendor product: WP Booking System – Booking Calendar
CVE-2026-3717Published
CV Builder – Professional Resume Builder SaaS <= 1.3.1 - Missing Authorization to Unauthenticated PNG File Upload
cve-program ·
Vendor product: WP CV Builder
CVE-2026-104006Published
SpeedyCache <= 1.4.2 - Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check
cve-program ·
Vendor product: SpeedyCache – Cache, Optimization, Performance
CVE-2026-96662Published
Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' Parameter
cve-program ·
Vendor product: Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
CVE-2026-104803Published
WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback
cve-program ·
Vendor product: WPCOM Member
CVE-2026-96653Published
WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)
cve-program ·
Vendor product: WP Directory Kit
CVE-2026-104728Published
AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via wp_ajax_automatorwp_fluentform_get_forms AJAX Action
cve-program ·
Vendor product: AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI
CVE-2026-104759Published
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce Verification
cve-program ·
Vendor product: WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
CVE-2026-102291Published
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'
cve-program ·
Vendor product: Kirki – Freeform Page Builder, Website Builder & Customizer
CVE-2026-93746Published
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameter
cve-program ·
Vendor product: WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels
CVE-2026-91136Published
Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' Parameter
cve-program ·
Vendor product: Divi Plus
CVE-2026-104722Published
Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.2 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'ix[file]' Parameter
cve-program ·
Vendor product: Listdom: AI-powered Business Directory with Classifieds Ads Listings
CVE-2026-103520Published
HivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format
cve-program ·
Vendor product: HivePress – Business Directory, Listings & Classified Ads Plugin
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.