WordPress MDJM Event Management plugin < 1.7.8.5 - Unauthenticated Arbitrary Post Deletion vulnerability

Unauthenticated Arbitrary Post Deletion vulnerability discovered by Enrico Marcolini Dottor Marc, Claudio Marchesini Dottor Marc in WordPress Plugin Mobile DJ Manager versions 1.7.8.5...

WordPress Album Cover Finder plugin <= 0.7.0 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by João Ramos Maciel in WordPress Plugin Album Cover Finder versions = 0.7.0...

WordPress wpstorecart plugin <= 5.0.7 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by reconnaissance in WordPress Plugin WPStoreCart versions = 5.0.7...

WordPress SAMO Forms plugin <= 1.0.0 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by João Ramos Maciel in WordPress Plugin SAMO Forms versions = 1.0.0...

WordPress Frontegg SAML SSO plugin <= 1.0.1 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by moonge in WordPress Plugin Frontegg SAML SSO versions = 1.0.1...

WordPress Quads Ads Manager for Google AdSense plugin 3.0.4 - Subscriber+ Ad-Selling Payment Bypass vulnerability

Subscriber+ Ad-Selling Payment Bypass vulnerability discovered by JunHee CHO in WordPress Plugin Ads by WPQuads versions 3.0.4...

WordPress CODE MONKEYS PROPOSALS plugin <= 1.0.1 - Subscriber+ Arbitrary File Deletion vulnerability

Subscriber+ Arbitrary File Deletion vulnerability discovered by João Ramos Maciel in WordPress Plugin Code Monkeys Proposals versions = 1.0.1...

WordPress Gpx2Graphics plugin <= 0.3 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Huynh Kien Minh in WordPress Plugin Gpx2Graphics versions = 0.3...

WordPress WebTotem Backups plugin <= 1.0.1 - Subscriber+ Arbitrary File Deletion vulnerability

Subscriber+ Arbitrary File Deletion vulnerability discovered by João Ramos Maciel in WordPress Plugin WebTotem Backups versions = 1.0.1...

WordPress DS Ad Rotator plugin <= 0.8 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Huynh Kien Minh in WordPress Plugin DS Ad Rotator versions = 0.8...

WordPress CryptoPayment Gateway plugin 1.2.1-1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update vulnerability

Unauthenticated Arbitrary File Deletion and Settings Update vulnerability discovered by Pedro Pinho in WordPress Plugin CryptoPayment Gateway versions 1.2.1-1.2.2...

WordPress Yogeta WP Cloud plugin <= 1.0 - Unauthenticated Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download vulnerability discovered by Huynh Kien Minh in WordPress Plugin Yogeta WP Cloud versions = 1.0...

WordPress User Registration & Membership plugin 4.4.6-5.2.7 - Subscriber+ Privilege Escalation vulnerability

Subscriber+ Privilege Escalation vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin User Registration versions 4.4.6-5.2.7...

WordPress WP Component plugin <= 2.2.4 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin WP Component versions = 2.2.4...

WordPress Add User Autocomplete plugin < 1.2 - Subscriber+ Privilege Escalation vulnerability

Subscriber+ Privilege Escalation vulnerability discovered by Nguyen Huu Do in WordPress Plugin Add User Autocomplete versions 1.2...

WordPress MemberPress Corporate Accounts plugin <= 1.5.39 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by andrea bocchetti in WordPress Plugin MemberPress Corporate Accounts versions = 1.5.39...

PT-2026-91402

ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stored offer records, delete arbitrary offers by numer...

PT-2026-91411

Name of the Vulnerable Software and Affected Versions Really Simple Security plugin for WordPress versions prior to 9.8.2 Description An authorization check is missing in the profile-page update handler, allowing authenticated low-privileged attackers to bypass enforced two-factor authentication...

PT-2026-91859

Name of the Vulnerable Software and Affected Versions 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery versions prior to 1.16.21 Description Unauthenticated attackers can extract sensitive data from password-protected flipbooks by exploiting the id parameter. This allows th...

CVE-2026-85129

The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which wi...