PT-2026-93296

The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authenticated user, including a Subscriber with no board access, to disclose the private board memberships of arbitrary users by referencing the...

CVE-2026-86784: Improper Neutralization of Input During Web Page Generation

The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such...

CVE-2026-86823: URL Redirection to Untrusted Site

The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthenticated attackers to redirect users to arbitrary external sites and to disclose a subscriber token that grants access to that subscriber...

PT-2026-93316

The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges before performing several board-management operations, checking only board membership. This allows any member of a board to carry out manager-only actions on it, including adding or...

PT-2026-93269

Name of the Vulnerable Software and Affected Versions WP Directory Kit versions prior to 1.5.5 Description The plugin is susceptible to blind SQL Injection, a technique that allows an attacker to infer data from a database by observing the application's response to specific queries. The issue...

PT-2026-93278

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remot...

WordPress Blog2Social: Social Media Auto Post & Scheduler plugin <= 9.0.0 - Authenticated (Subscriber+) Username Enumeration vulnerability

Authenticated Subscriber+ Username Enumeration vulnerability discovered by Choriyev Qahramon in WordPress Plugin Blog2Social versions = 9.0.0...

CVE-2026-89027 miniOrange JWT Authentication for WP REST APIs < 4.8.0 Authentication Downgrade

miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or...

EUVD-2026-79746

miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or...

CVE-2026-89027

miniOrange JWT Authentication for WP REST APIs plugin for WordPress (before 4.8.0 ) contains an authentication method downgrade vulnerability. An unauthenticated attacker can supply a specific GET parameter that bypasses capability checks and nonce verification, forcing the plugin to use Basic HT...

WordPress Admin Menu Editor Pro 2.35-2.36 - Backdoor vulnerability

Backdoor vulnerability discovered by Unknown in WordPress Plugin Admin Menu Editor Pro versions 2.35-2.36...

WordPress Online Scheduling and Appointment Booking System plugin <= 28.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter vulnerability

Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversationid' Parameter vulnerability discovered by jtb75 - NG20 LLC in WordPress Plugin Bookly versions = 28.1...

WordPress Bold Page Builder plugin <= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'shortcodecontent' Parameter vulnerability discovered by suyoung kimAhnLab - AhnLab in WordPress Plugin Bold Page Builder versions = 5.9.6...

WordPress WP-Lister Lite for eBay plugin <= 3.8.9 - Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request vulnerability

Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request vulnerability discovered by thevietronin - GalaxyOne in WordPress Plugin WP-Lister Lite for eBay versions = 3.8.9...

WordPress JetFormBuilder plugin <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter

Unauthenticated Privilege Escalation via 'jetenginebookingformid' Parameter vulnerability discovered by daroo in WordPress Plugin JetFormBuilder versions = 3.6.2...

WordPress Advanced Popups plugin <= 1.2.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Notification Button Link' Field vulnerability

Authenticated Author+ Stored Cross-Site Scripting via 'Notification Button Link' Field vulnerability discovered by Nguyen Cong Quang in WordPress Plugin Advanced Popups versions = 1.2.3...

WordPress Ad Inserter plugin <= 2.8.16 - Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter vulnerability

Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter vulnerability discovered by Evan - Independent Security Researcher in WordPress Plugin Ad Inserter versions = 2.8.16...

WordPress Contest Gallery plugin <= 32.0.1 - Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter vulnerability

Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter vulnerability discovered by mad4cyber - nonprofit in WordPress Plugin Contest Gallery versions = 32.0.1...

WordPress TrueBooker plugin <= 1.2.3 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Devlin Jenkins in WordPress Plugin TrueBooker versions = 1.2.3...

CVE-2026-18063

The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'positionbutton' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...