PT-2026-107407

The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes...

CVE-2026-82212: Insufficient Verification of Data Authenticity

The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orders as paid, or to mark genuinely paid...

PT-2026-107418

The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orders as paid, or to mark genuinely paid...

PT-2026-107400

The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting user is authorized to access before returning that question's answer options, allowing any authenticated user with access to a single course, such as an enrolled student, to rea...

CVE-2026-103378: Exposure of Sensitive Information to an Unauthorized Actor

The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attacker...

PT-2026-107405

The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromi...

CVE-2026-87782: Improper Privilege Management

The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a role selection submitted with a profile update, allowing any authenticated user, such as a subscriber, to grant themselves the Administrator role...

PT-2026-107416

Name of the Vulnerable Software and Affected Versions Magee Shortcodes WordPress plugin versions prior to 2.1.2 Description The plugin fails to restrict the recipient of certain unauthenticated contact-form actions. This allows unauthenticated users to perform a mail relay, sending arbitrary emai...

PT-2026-107408

Name of the Vulnerable Software and Affected Versions Magee Shortcodes WordPress plugin versions prior to 2.1.2 Description Reflected Cross-Site Scripting occurs because the plugin fails to sanitize and escape user input in certain AJAX actions available to unauthenticated users before reflecting...

PT-2026-107417

Name of the Vulnerable Software and Affected Versions Nexi XPay Build WordPress plugin versions prior to 7.6.3 Description The plugin fails to verify payment results sent to several unauthenticated routes. This allows an attacker to manipulate order statuses by marking arbitrary orders as paid or...

CVE-2026-102173: Improper Neutralization of Input During Web Page Generation

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in all versions up to, and including, 6.3.1 This is due to insufficient escaping in ExceptionalElements::imageelement, which concatenates a...

Linux Distros Unpatched Vulnerability : CVE-2026-66666

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress:...

CVE-2024-1207

Booking Calendar = 9.9 - Unauthenticated SQL Injection CVE-2024-1207 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/booking/booking-calendar-99-unauthenticated-sql-injection POC: POST /wp-admin/admin-ajax.php HTTP/1.1 Host: vulnerablesite.com User-Agent: Mozilla/5.0...

cve-2026-87902-poc

CVE-2026-87902 — WordPress Core: path traversal non autenticato nella risoluzione dei template di pagina Inclusione locale non autenticata di file PHP in WordPress Core tramite un valore pagename con doppia codifica — e, in specifiche condizioni di deployment, esecuzione di codice PHP con i...

NPM: knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json

NPM: knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json vulnerability discovered by ? in WordPress Npm knowns versions = 0.29.1...

DEBIAN-CVE-2026-66666

Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6...

CVE-2026-66666

Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6...

WordPress Core 7.1.0-7.1.2 - Unauthenticated Stored Cross-Site Scripting via Pending Comments (Comments administration screen) vulnerability

Unauthenticated Stored Cross-Site Scripting via Pending Comments Comments administration screen vulnerability discovered by Thomas Chauchefoin Trail of Bits in WordPress core versions 7.1-7.1.2...

WordPress Core <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Imgur oEmbed vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Imgur oEmbed vulnerability discovered by Zhengyu Liu, Jingcheng Yang, Gavin Zhong in WordPress core versions = 7.1.2...

WordPress Core <= 7.1.2 - Author+ Broken Access Control to Sticky Posts via REST API vulnerability

Author+ Broken Access Control to Sticky Posts via REST API vulnerability discovered by Anthropic in WordPress core versions = 7.1.2...