contact@wpscan.com
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS contact@wpscan.com
03
assessed vulnerabilities (198)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-85683US | — | — | ||
The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing them to… | ||||
| CVE-2026-14556US | — | — | ||
The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthentic… | ||||
| CVE-2026-107447US | — | — | ||
The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied re… | ||||
| CVE-2026-105256US | —OT elevated | — | ||
The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site a… | ||||
| CVE-2026-104642US | —OT elevated | — | ||
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can set, allowing users with the Contributor rol… | ||||
| CVE-2026-104641US | —OT elevated | — | ||
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its defaul… | ||||
| CVE-2026-103301US | —OT elevated | — | ||
The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming payment notifications, because the secret used to sign them is empty by d… | ||||
| CVE-2026-101138US | — | — | ||
The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pattern, a… | ||||
| CVE-2026-94294US | —OT elevated | — | ||
The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauth… | ||||
| CVE-2026-94272US | —OT elevated | — | ||
The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated atta… | ||||
| CVE-2026-94231US | —OT elevated | — | ||
The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking s… | ||||
| CVE-2026-94230US | —OT elevated | — | ||
The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing… | ||||
| CVE-2026-94229US | — | — | ||
The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enum… | ||||
| CVE-2026-94228US | —OT elevated | — | ||
The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the token it does check is issued to unauthenticated visitors,… | ||||
| CVE-2026-91831US | — | — | ||
The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing use… | ||||
| CVE-2026-86791US | —OT elevated | — | ||
The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a payment was actually completed before recording an order as paid, allowing unauthe… | ||||
| CVE-2026-74922US | —OT elevated | — | ||
The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which i… | ||||
| CVE-2026-74921US | — | — | ||
The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes before embedding them in a single-quoted HTML attribute in the… | ||||
| CVE-2026-110034US | — | — | ||
The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount discount from a booking's total, allowing an unauthenti… | ||||
| CVE-2026-106010US | —OT elevated | — | ||
The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route and treats unset credentials as valid, all… | ||||