CVE-2026-105397: Improper Neutralization of Input During Web Page Generation

LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the updatequestion...

CVE-2026-13607: Improper Access Control

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...

PT-2026-104730

The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files...

Exploit for CVE-2026-96451

CVE-2026-96451 WordPress Ultimate Member plugin = 2.13.1 -...

WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Phat RiO in WordPress Plugin Zombify versions = 1.7.7...

WordPress Haaken theme <= 1.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Denver Jackson in WordPress Theme Haaken versions = 1.5...

WordPress Grand Restaurant theme < 7.0.11 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Grand Restaurant versions 7.0.11...

WordPress Total Donations plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Total Donations versions = 2.0.5...

WordPress Sermon'e plugin <= 1.0.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Sermon'e versions = 1.0.2...

WordPress Progressify - Progressive Web App (PWA) plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability

WordPress Progressify - Progressive Web App PWA plugin = 1.6.0 - Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Progressify - Progressive Web App PWA versions = 1.6.0...

WordPress Ohio Extra plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Ohio Extra versions = 3.6.8...

WordPress WP User Frontend Pro plugin <= 4.2.13 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin WP User Frontend Pro versions = 4.2.13...

WordPress Smart Forms plugin <= 2.6.104 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by HaiND in WordPress Plugin Smart Forms versions = 2.6.104...

WordPress Frontend File Manager plugin <= 23.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Chamseddine Bouzaiene in WordPress Plugin Frontend File Manager versions = 23.6...

WordPress SUMO Affiliates Pro plugin <= 11.7.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin SUMO Affiliates Pro versions = 11.7.0...

WordPress Faktur Pro for WooCommerce plugin <= 3.2.2 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by HieuPenguinnn in WordPress Plugin Faktur Pro for WooCommerce versions = 3.2.2...

WordPress ECPay Ecommerce for WooCommerce plugin <= 1.1.2606090 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Tran The Long in WordPress Plugin ECPay Ecommerce for WooCommerce versions = 1.1.2606090...

WordPress Kognetiks Chatbot for WordPress plugin <= 2.4.9 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by HaiND in WordPress Plugin Kognetiks Chatbot for WordPress versions = 2.4.9...

WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by ParkHyunWoo in WordPress Plugin PDF Smart Viewer for Elementor versions = 1.0.4...

WordPress Kubio AI Page Builder plugin <= 2.9.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Kubio AI Page Builder versions = 2.9.3...