CVE-2026-80518: Exposure of Sensitive Information to an Unauthorized Actor

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of...

CVE-2026-100149: Exposure of Sensitive Information to an Unauthorized Actor

The WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.7.3 via the 'x-yamidoo-signature attacker-obtained via inlinejs identify payload' parameter. This makes it possible...

CVE-2026-87091: Improper Neutralization of Input During Web Page Generation

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Settlement Notification Parameters in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-103514: Improper Authentication

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on...

CVE-2026-97660: Improper Neutralization of Input During Web Page Generation

The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo- Array Key via Multipart Field Name in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

CVE-2026-89236: Improper Neutralization of Special Elements used in an SQL Command

The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database...

CVE-2026-92767: Improper Neutralization of Input During Web Page Generation

The Twenty20 Image Before-After plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'offset' Shortcode Attribute in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2026-104517

Name of the Vulnerable Software and Affected Versions WP Ultimate Review WordPress plugin versions prior to 2.4.4 Description Unauthenticated users can store crafted review content that causes the reviewed page to fail with a fatal error on every subsequent visit. This leads to a persistent denia...

CVE-2026-100148: Improper Neutralization of Input During Web Page Generation

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'reviews.text' parameter in all versions up to, and including, 7.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-92727: Improper Neutralization of Input During Web Page Generation

The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slidesShow' Block Attribute in all versions up to, and including, 4.6.6 due to insufficient input sanitization and...

Fedora 43 : wordpress (2026-5c9d8e41a9)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5c9d8e41a9 advisory. WordPress 6.9.9 Security Release Security updates included in this release - Unauthenticated path traversal in page-template resolution leading to conditiona...

CVE-2026-94505: Missing Authorization

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-97644: Improper Privilege Management

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists because the createcontact function in the v3 REST endpoint POST /gh/v3/contacts ...

CVE-2026-104313: Improper Neutralization of Input During Web Page Generation

The WPC Estimated Delivery Date for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ruledata' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

PT-2026-104545

Name of the Vulnerable Software and Affected Versions The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress versions prior to 1.8.47 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting...

CVE-2026-11601: Missing Authorization

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possibl...

CVE-2026-103909: Improper Neutralization of Input During Web Page Generation

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'arbitrary whichever names the admin bound via url. ' parameter in all versions up to, and including, 5.5.1.5 du...

PT-2026-104531

Name of the Vulnerable Software and Affected Versions Mailchimp for WooCommerce WordPress plugin versions prior to 6.3 Description An issue exists where the plugin fails to require authentication, a nonce a unique token used to prevent replay attacks, or an ownership check before processing actio...

PT-2026-104528

Name of the Vulnerable Software and Affected Versions Kubio AI Page Builder WordPress plugin versions prior to 2.9.3 Description The plugin fails to restrict the expansion of allowed HTML elements to the editor context. Consequently, this expanded set of allowed elements is applied to content...

PT-2026-104550

Name of the Vulnerable Software and Affected Versions Burst Statistics – Simple WordPress Analytics Google Analytics Alternative versions prior to 3.7.2 Description Improper authentication allows for account persistence. The maybe load shared dashboard handler issues a genuine WordPress session...