PT-2026-86407

The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users in paid courses...

PT-2026-86309

The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'consent message' JSON Attribute in .qlwapp data-box in all versions up to, and including, 8.6.2 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-86337

Name of the Vulnerable Software and Affected Versions IPGP Visitors Origin WordPress plugin versions prior to 1.6 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting XSS attacks. This occurs when user input is...

PT-2026-86332

🚨 CVE-2026-78149 The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored password through an unauthenticated AJAX action, allowing unauthenticated users to read protected post content and the password that guards...

PT-2026-86345

🚨 CVE-2026-84022 The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected...

CVE-2026-84926: Exposure of Sensitive Information to an Unauthorized Actor

The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from...

CVE-2026-83544: Improper Neutralization of Input During Web Page Generation

The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed...

PT-2026-86361

The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-lev...

PT-2026-86356

🚨 CVE-2026-84931 The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute ...

PT-2026-86325

Name of the Vulnerable Software and Affected Versions JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin versions prior to 3.6.5.2 Description Insufficient authorization checks during page rendering when resolving request-derived data allow unauthenticated users to read arbitrary user,...

PT-2026-86342

🚨 CVE-2026-83543 The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to arbitrary hosts and read the response. 🎖@cveNotify...

PT-2026-86357

Name of the Vulnerable Software and Affected Versions JCH Optimize WordPress versions prior to 6.0.1 Description An issue exists where the plugin fails to perform a capability check on an authenticated AJAX action, allowing the request to determine which internal action is executed. This enables...

PT-2026-86350

🚨 CVE-2026-84898 The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files. 🎖@cveNotify...

PT-2026-86358

Name of the Vulnerable Software and Affected Versions HT Menu WordPress plugin versions prior to 1.2.7 Description Insufficient input sanitization and output escaping allow authenticated users with minimal permissions, such as Subscribers, to perform Stored Cross-Site Scripting XSS. The plugin...

PT-2026-86339

🚨 CVE-2026-81424 The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that the product fulfilled when a checkout is completed matches the product the authoritative payment was actually made for, checking only that the amount paid is at least the referenced product's price,...

PT-2026-86366

Name of the Vulnerable Software and Affected Versions ComboBlocks versions 2.2.32 through 2.3.1 Description The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress contains an Unauthenticated Hook Injection flaw. This issue occurs through several functions within the...

PT-2026-86311

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-86316

🚨 CVE-2025-15693 The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to...

PT-2026-86473

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions prior to 3.29.13 Description An authentication bypass allows unauthenticated attackers to take over accounts. The issue occurs because the pre update value function lacks capability or ownership checks, an...

PT-2026-86322

The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text Field Entity-Encoded Payload in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes i...