PT-2026-95263

Name of the Vulnerable Software and Affected Versions Clean Login WordPress plugin versions prior to 1.19 Description The plugin fails to verify the registration CAPTCHA when the stored session value is empty. This allows unauthenticated users to bypass anti-automation controls on the registratio...

CVE-2026-81340: Authorization Bypass Through User-Controlled Key

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users'...

PT-2026-95231

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description Insufficient per-object ownership or capability checks occur when updating orders via the REST API. This allows users with the Instructor role to modify any order on the sit...

CVE-2026-87771: Improper Neutralization of Special Elements used in an SQL Command

The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape parameters before using them in SQL queries on AJAX actions available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...

WordPress JWT Authentication for WP REST APIs plugin <= 4.7.0 - Unauthenticated Authentication Method Downgrade vulnerability

Unauthenticated Authentication Method Downgrade vulnerability discovered by Choriyev Qahramon in WordPress Plugin WordPress REST API Authentication versions = 4.7.0...

CVE-2026-91010

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action, and only tests that a nonce parameter is present rather than validating it, allowing any authenticated user, such as a...

PT-2026-94158

Name of the Vulnerable Software and Affected Versions Dictionary WordPress plugin versions prior to 1.1 Description The plugin fails to escape user input before reflecting it in the responses of several directly accessible scripts. This allows unauthenticated attackers to execute Reflected...

PT-2026-94174

Name of the Vulnerable Software and Affected Versions Autopay WordPress plugin versions prior to 5.0.1 Description An issue exists where the plugin fails to enforce the signature on a payment callback. This allows unauthenticated users to disclose and delete stored payment parameters associated...

CVE-2026-91011: Improper Neutralization of Input During Web Page Generation

The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...

CVE-2026-91017: Insufficient Verification of Data Authenticity

The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders...

CVE-2026-88792: Improper Neutralization of Input During Web Page Generation

The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry...

PT-2026-94167

Name of the Vulnerable Software and Affected Versions Newsletter WordPress plugin versions prior to 9.3.8 Description The plugin fails to generate its email tracking signing key with sufficient entropy and utilizes an unkeyed hash to sign tracking links. This allows an unauthenticated attacker wh...

PT-2026-94168

Name of the Vulnerable Software and Affected Versions Dewa Kirim versions prior to 1.0.1 Description The Dewa Kirim WordPress plugin fails to escape delivery coordinates submitted during the checkout process before they are output within an inline script. This allows unauthenticated users to...

CVE-2026-86707: Improper Authentication

The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...

PT-2026-94181

Name of the Vulnerable Software and Affected Versions Motors WordPress plugin versions prior to 1.4.121 Description An authorization bypass exists that allows unauthenticated attackers to access non-published car listings, including those in draft, pending, and private status. By providing a...

CVE-2026-86801: Missing Authentication for Critical Function

The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content, allowing unauthenticated...

CVE-2026-87786: Improper Neutralization of Input During Web Page Generation

The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allowing unauthenticated users to store JavaScript that runs in the session of an administrator who later opens the order...

CVE-2025-15697: Improper Neutralization of Input During Web Page Generation

The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessible scripts, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone they can induce to submit a crafted request...

PT-2026-94170

Name of the Vulnerable Software and Affected Versions Dictionary WordPress plugin versions prior to 1.1 Description Lack of authorization, sanitization, and escaping when adding or updating dictionary entries allows unauthenticated users to perform a Stored Cross-Site Scripting XSS attack. This...

EUVD-2026-80220

The Appointment Hour Booking WordPress plugin before 1.5.95 does not check every appointment in a booking submission against the capacity configured for its own slot, allowing unauthenticated visitors to take slots that are already fully booked...