CVE-2026-75962 Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log)

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and...

CVE-2026-75962

The Post SMTP WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 4.0.1 . The root cause is insufficient input sanitization and output escaping regarding the 'user_email' parameter. Attackers can bypass the plugin's validator by using numeric HT...

CVE-2026-41563 WordPress Sitemovr plugin <= 1.0.1 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Sitemovr = 1.0.1 versions...

CVE-2026-41563 WordPress Sitemovr plugin <= 1.0.1 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Sitemovr = 1.0.1 versions...

CVE-2026-39760 WordPress Real 3D FlipBook plugin <= 5.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Real 3D FlipBook = 5.5 versions...

CVE-2026-39599 WordPress WDS MCP Content Manager plugin <= 3.10.4 - Broken Access Control vulnerability

Contributor Broken Access Control in WDS MCP Content Manager = 3.10.4 versions...

CVE-2026-32582 WordPress IATO MCP plugin <= 1.12.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in iatoai IATO MCP iato-mcp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IATO MCP: from n/a through 1.12.0...

CVE-2026-32582

The WordPress IATO MCP plugin in versions

CVE-2026-32576

The Faktur Pro for WooCommerce plugin, specifically versions

wordpress-jetpack-broken-access-control-vulnerable-application

wordpress-jetpack-broken-access-control-vulnerable-application Esta es una aplicación vulnerable para probar el exploit del control de acceso roto Jetpack 13.9.1 CVE-2024-9926. ¡ADVERTENCIA! Esta aplicación contiene vulnerabilidades de seguridad graves. ¡Ejecútela bajo su propio riesgo! Se...

CVE-2026-0920

CVE-2026-0920 Scanner A Python-based scanner for detecting and validating CVE-2026-0920 exposure in WordPress sites using vulnerable LA-Studio Element plugin versions. Overview This tool is designed to automate the identification of WordPress targets potentially affected by CVE-2026-0920 , a...

CVE-2026-86786: Exposure of Sensitive Information to an Unauthorized Actor

The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the title, excerpt and permalink of non-public posts, including drafts, pending, scheduled, private and trashed posts, as wel...

CVE-2026-94270: Improper Authentication

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and ships with that verification disabled by default, allowing unauthenticated attackers to mark an unpaid order as paid, or to cancel or refund an existing order...

PT-2026-106342

The ACPT Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes ...

CVE-2026-41559: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup & Restore = 2.1.2 versions...

PT-2026-106333

Name of the Vulnerable Software and Affected Versions Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App versions prior to 4.0.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform...

PT-2026-106834

Name of the Vulnerable Software and Affected Versions WordPress versions 6.6 through 6.6.9 WordPress versions 6.7 through 6.7.9 WordPress versions 6.8 through 6.8.10 WordPress versions 6.9 through 6.9.9 WordPress versions 7.0 through 7.0.6 WordPress versions 7.1 through 7.1.2 Description An issue...

PT-2026-106337

Name of the Vulnerable Software and Affected Versions Fast Courier versions prior to 5.2.4 Description The Fast Courier WordPress plugin fails to restrict an unauthenticated REST route used for writing order fulfillment data. This allows unauthenticated attackers to overwrite the courier status a...

PT-2026-106340

Name of the Vulnerable Software and Affected Versions File Media Renamer versions prior to 1.4 Description The File Media Renamer WordPress plugin fails to verify if the requesting user is authorized to modify a specific media attachment. This allows any user with file-upload privileges to rename...

PT-2026-106338

Name of the Vulnerable Software and Affected Versions Deema Payment Gateway versions prior to 1.1.3 Description The Deema Payment Gateway WordPress plugin fails to verify the authenticity of incoming payment provider notifications. Because this verification is disabled by default, unauthenticated...