PT-2026-99246

Name of the Vulnerable Software and Affected Versions Bluff Post WordPress plugin versions prior to 1.1.2 Description Insufficient sanitization and escaping of parameters used as identifiers in a SQL query allow unauthenticated attackers to append additional SQL commands. This can lead to the...

PT-2026-99241

Name of the Vulnerable Software and Affected Versions File Manager WordPress plugin versions prior to 8.0.5 Description An issue exists where unauthenticated users can download database backup archives. In certain scenarios, these archives are saved using a fixed filename, enabling attackers to...

CVE-2026-100667: Missing Critical Step in Authentication

grav-plugin-login the Grav CMS Login plugin versions = 3.8.7 and 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated Twig function or the authenticated shortcode. On sites with 2FA enabled, Login::isAuthenticated checked only the session flag...

PT-2026-99396

Name of the Vulnerable Software and Affected Versions UP plugin extension versions 5.0.0 through 5.2.0 UP plugin extension versions 6.0.0 through 6.0.29 Description Various path traversal and file access vectors exist within the UP plugin extension. Path traversal is a technique that allows an...

CVE-2026-97163: Improper Limitation of a Pathname to a Restricted Directory

Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29...

PT-2026-99398

Name of the Vulnerable Software and Affected Versions Joomla UP plugin versions 5.0.0 through 5.2.0 Joomla UP plugin versions 6.0.0 through 6.0.29 Description An issue exists that allows unauthenticated remote code installation within the Joomla UP plugin extension. Recommendations At the moment,...

PT-2026-99245

Name of the Vulnerable Software and Affected Versions File Manager WordPress plugin versions prior to 8.0.5 FileOrganizer WordPress plugin versions prior to 1.2.1 File Manager Pro WordPress plugin versions prior to 2.1.3 Description These plugins fail to correctly validate the origin of window...

CVE-2026-97160: Improper Control of Generation of Code

Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29...

CVE-2026-97162: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29...

CVE-2026-100697: Server-Side Request Forgery (SSRF)

Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin plugins/drivers/clickhouse.php, rewritten in 6.0.0 is loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit authdriver=clickhouse with authserver set to an arbitrary U...

CVE-2026-97161: Improper Limitation of a Pathname to a Restricted Directory

Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29...

CVE-2026-96533: Server-Side Request Forgery (SSRF)

The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response as a public file, allowing unauthenticated users to make the server issue requests to internal services and read the responses...

CVE-2026-85081: Improper Neutralization of Input During Web Page Generation

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading...

CVE-2026-16591: Improper Neutralization of Input During Web Page Generation

The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category and location fields before outputting them in page attributes, allowing users with a WP Directory Kit WordPress plugin before 1.5.8-specific listing-management role and without the unfilteredhtml...

CVE-2026-100599: Improper Neutralization of Special Elements used in an OS Command

OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec approval path to Google Meet node commands. The googlemeet.chrome command accepts caller-supplied audio command arrays and executes them on a paired node without going through the normal system.run approval flow. In...

CVE-2026-89237: Improper Neutralization of Special Elements used in an SQL Command

The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allowing unauthenticated attackers to append additional SQL and extract sensitive information from the database...

PT-2026-99395

Name of the Vulnerable Software and Affected Versions UP plugin versions 5.0.0 through 5.2.0 UP plugin versions 6.0.0 through 6.0.29 UP plugin versions prior to 6.1.0 Description An authenticated, privileged PHP command injection exists in the UP plugin extension. Additionally, an unauthenticated...

PT-2026-99253

Name of the Vulnerable Software and Affected Versions Testimonials Widget WordPress plugin versions prior to 4.0.5 Description The plugin fails to validate a user-supplied URL before fetching it server-side and storing the response as a public file. This allows unauthenticated users to perform a...

PT-2026-99251

Name of the Vulnerable Software and Affected Versions Optimole WordPress plugin versions prior to 4.2.13 Description The plugin fails to escape unrecognized attributes within its video-player block before rendering them onto the block's wrapper element. This allows users with the Author role or...

PT-2026-99338

Name of the Vulnerable Software and Affected Versions grav-plugin-login versions 3.8.7 through 3.9.6 Description A flaw exists where the two-factor authentication 2FA challenge can be bypassed for content protected by the authenticated Twig function or the authenticated shortcode. This occurs...