EUVD-2026-63200

The AI Agent by SiteGround plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to upload images...

CVE-2026-17153 AI Agent by SiteGround <= 1.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Upload via /generate-content REST Endpoint

The AI Agent by SiteGround plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to upload images...

CVE-2026-17153

AI Agent by SiteGround plugin (≤1.2.7) has a missing authorization check on its /generate-content REST endpoint, allowing authenticated Contributor-level users to upload images to the media library despite lacking the upload_files capability. The sg_ai_studio_gutenberg_nonce is issued to any bloc...

EUVD-2026-63199

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the emesingleeventpagetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .p...

CVE-2026-75963 Events Made Easy <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Property

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the emesingleeventpagetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .p...

WordPress File Manager Plugin - Remote Code Execution

The WordPress File Manager plugin prior to version 6.9 is susceptible to remote code execution. The vulnerability allows unauthenticated remote attackers to upload .php files. id: CVE-2020-25213 Uploaded file will be accessible at:-...

PT-2026-78990

Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...

PT-2026-78976

Unauthenticated PHP Object Injection in Flatastic = 2.0 versions...

PT-2026-78888

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the eme single event page template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrar...

PT-2026-78991

Subscriber Arbitrary File Upload in Warehouse Cargo = 2.6.9 versions...

PT-2026-78968

Unauthenticated SQL Injection in TheGem Elementor = 5.12.3 versions...

NPM: SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses

NPM: SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses vulnerability discovered by ? in WordPress Npm mcp-searxng versions 1.12.0...

NPM: SearXNG MCP Server: Additional hardened-mode SSRF bypasses

NPM: SearXNG MCP Server: Additional hardened-mode SSRF bypasses vulnerability discovered by ? in WordPress Npm mcp-searxng versions 1.2.1...

CVE-2026-18315

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the adminusercreatecus AJAX handler lacking any authentication o...

CVE-2026-18315

The TrueBooker – Appointment Booking and Scheduler System WordPress plugin (all versions ≤ 1.2.6 ) contains an unauthenticated authorization bypass in the admin_user_create_cus AJAX handler. The handler passes the attacker-controlled truebooker_wp_user_id parameter directly to wp_update_user with...

CVE-2026-18315 TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the adminusercreatecus AJAX handler lacking any authentication o...

EUVD-2026-62630

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the adminusercreatecus AJAX handler lacking any authentication o...

EUVD-2026-62595

Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1...

CVE-2026-32475

Elementor Pro WordPress plugin (≈6,000,000 active installations) is vulnerable to unauthenticated arbitrary file upload in all versions up to and including 4.2.1 . The root cause is a logic error in the Upload::validation() function where return is used instead of continue when the first array el...

CVE-2026-32475 WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1...