PT-2026-90561

The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rights, allowing an administrator of a single site on a multisite network to take over the whole...

PT-2026-90570

The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS...

PT-2026-90590

The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers, allowing unauthenticated attackers to make those third-party API calls, and consume the associated cost, using the site's own...

PT-2026-90580

The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site'...

PT-2026-96697

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable...

PT-2026-90558

Name of the Vulnerable Software and Affected Versions WebTotem Backups versions prior to 1.0.2 Description The plugin fails to validate user-supplied file paths, does not verify the capabilities of the user making the request, and ignores the results of its own Cross-Site Request Forgery CSRF...

PT-2026-90579

Name of the Vulnerable Software and Affected Versions WP Images Upload on Piclect versions prior to 1.1 Description The plugin fails to validate the name or type of uploaded files before saving them to a publicly accessible directory. This allows unauthenticated attackers to upload arbitrary file...

PT-2026-90576

The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and...

PT-2026-90588

The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email...

PT-2026-90587

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...

PT-2026-90559

The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway...

PT-2026-90652

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1 Description The Bookmark plugin fails to validate user permissions, allowing unauthenticated attackers to read chapter names from password-protected videos. By queryi...

PT-2026-90566

Name of the Vulnerable Software and Affected Versions Gpx2Graphics WordPress plugin versions prior to 0.4 Description The plugin fails to perform a Cross-Site Request Forgery CSRF check during file upload operations and does not validate the type of uploaded files. This allows an attacker to tric...

PT-2026-90562

The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site ov...

PT-2026-90577

Name of the Vulnerable Software and Affected Versions Album Cover Finder versions prior to 0.7.1 Description The Album Cover Finder WordPress plugin fails to properly sanitize and escape the and action parameter before incorporating it into a SQL query. This flaw allows unauthenticated users to...

PT-2026-90560

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the...

PT-2026-90556

Name of the Vulnerable Software and Affected Versions Frontegg SAML SSO WordPress plugin versions prior to 1.0.2 Description The plugin fails to verify the signature or issuer of SAML authentication responses before establishing a session. This allows unauthenticated attackers to log in as any...

PT-2026-90585

The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin befor...

PT-2026-90599

The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

PT-2026-90600

🚨 CVE-2026-85200 The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmw posts locator ajax info window loader function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on t...