Title	CVE ID	CVSS	Vector	Date
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2026-76546	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	August 29, 2026
Booking Package < 1.7.25 - Unauthenticated Price Manipulation	CVE-2026-16986	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	August 24, 2026
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred < 3.2.5 - Unauthenticated Payment Bypass	CVE-2026-15150	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	August 24, 2026
Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1066 - Authenticated (Administrator+) Remote Code Execution	CVE-2026-13405	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	August 21, 2026
Eventin <= 4.1.20 - Authenticated (Contributor+) Insecure Direct Object Reference to Speaker Account Deletion	CVE-2026-13174	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	August 17, 2026
Eventin <= 4.1.20 - Insecure Direct Object Reference to Authenticated (Contributor+) Schedule Deletion and Modification	CVE-2026-13175	6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	August 17, 2026
User Verification <= 2.0.47 - Unauthenticated Insecure Direct Object Reference	CVE-2026-14861	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	August 17, 2026
Payment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass	CVE-2026-16621	7.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L	August 14, 2026
Import WP – Export and Import CSV and XML files to WordPress < 2.14.23 - Unauthenticated Information Exposure	CVE-2026-14925	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	August 14, 2026
Booking for Appointments and Events Calendar – Amelia < 2.4.6 - Authenticated (Custom role+) Information Exposure	CVE-2026-14213	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	August 14, 2026
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) < 1.8.12 - Unauthenticated Donation Payment Bypass	CVE-2026-16650	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	August 14, 2026
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 - Authenticated (Contributor+) Information Exposure	CVE-2026-13168	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	August 13, 2026
Fluent Forms <= 6.2.4 - Insecure Direct Object Reference to Authenticated (Form Manager+) Cross-Form Submission Entry Deletion	CVE-2026-11578	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	August 11, 2026
Photo Album Plus <= 9.2.07.1 - Reflected Cross-Site Scripting	CVE-2026-17013	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	August 10, 2026
s2Member <= 260804 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2026-15047	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	August 7, 2026
Salon Booking System – Free Version <= 10.30.33 - Missing Authorization	CVE-2026-17021	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	August 6, 2026
Salon Booking System – Free Version <= 10.31.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Booking PII Disclosure	CVE-2026-17020	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	August 6, 2026
Restore PayPal Standard for WooCommerce <= 3.1.2 - Unauthenticated Payment Verification Bypass	CVE-2026-17012	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	August 5, 2026
CubeWP Framework <= 1.1.30 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post and User Meta Disclosure	CVE-2026-17018	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	August 5, 2026
Payment Button for PayPal <= 1.2.3.44 - Unauthenticated Payment Bypass	CVE-2026-16990	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	August 5, 2026

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation