CVE

CVE-2026-2381 affects WooCommerce Stripe Payment Gateway and allows unauthenticated attackers to change pending orders to Failed through the public wc_stripe_pay_for_order endpoint. The handler accepts a supplied order ID without checking order ownership or an order key. A request with a fake payment method can trigger a payment error that changes the selected order status. Versions through 10.7.0 are affected, with a fix in 10.8.0.

CVE-2025-15693: an Admin+ Path Traversal in the JCH Optimize WordPress plugin (4.2.1–5.0.0), reachable through the dir parameter of the filetree AJAX action. Details, timeline, PoC and remediation.

CVE-2025-15694: an Admin+ Stored XSS in the Joli Table Of Contents WordPress plugin (2.0.0–2.8.0), triggered through the headings_overflow setting on the plugin’s General tab. Details, timeline, PoC and remediation.

CVE-2026-9134 affects FooGallery and is an authenticated Contributor+ Stored Cross-Site Scripting vulnerability in versions up to and including 3.1.31. A crafted custom_attribute_key shortcode parameter can create an onmouseenter handler on the gallery container, causing persistent JavaScript to run when a visitor moves the pointer over the gallery. The issue is fixed in version 3.1.32.

CVE-2025-15663: an Author+ Stored XSS in the BEAF (Ultimate Before After Image Slider & Gallery) WordPress plugin below 4.7.19, triggered through the slider’s After Label field. Details, timeline, PoC and remediation.

CVE-2026-9125 affects Presto Player and is an authenticated Contributor+ Stored Cross-Site Scripting vulnerability in versions up to and including 4.2.0. A malicious presto_player_overlay shortcode can preserve a javascript: URI in link_url, allowing attacker-controlled JavaScript to run in the WordPress origin when another user clicks the overlay during playback.

CVE-2026-7526 affects PDF Embedder <= 4.9.3 and exposes site-wide plugin settings to authenticated Contributor+ users through the global pdfembPluginOptions JavaScript object. A saved premium license key can also be disclosed when the premium add-on is installed.

CVE-2026-3985 affects Creative Mail <= 1.6.9 with unauthenticated time-based SQL injection in the abandoned checkout flow. A crafted checkout UUID reaches an unprepared SQL query and can be used to infer sensitive database data.

CVE-2025-15345 affects MapGeo – Interactive Geo Maps and is an unauthenticated reflected Cross-Site Scripting vulnerability in versions up to and including 1.6.27. When a public page uses the display-map shortcode in demo mode, an attacker can supply an external JavaScript URL through the map parameter and make the victim browser load it under the vulnerable site context.

CVE-2026-6229 affects Royal Addons for Elementor and is an authenticated Contributor+ server-side request forgery vulnerability in the Data Table widget. In versions through 1.7.1057, a user-controlled CSV URL can bypass the Google Sheets substring check, reach arbitrary internal or external HTTP services, and expose response data after it is parsed into the rendered table.