PT-2026-90580

The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site'...

PT-2026-96697

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable...

PT-2026-90558

Name of the Vulnerable Software and Affected Versions WebTotem Backups versions prior to 1.0.2 Description The plugin fails to validate user-supplied file paths, does not verify the capabilities of the user making the request, and ignores the results of its own Cross-Site Request Forgery CSRF...

PT-2026-90579

Name of the Vulnerable Software and Affected Versions WP Images Upload on Piclect versions prior to 1.1 Description The plugin fails to validate the name or type of uploaded files before saving them to a publicly accessible directory. This allows unauthenticated attackers to upload arbitrary file...

PT-2026-90576

The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and...

PT-2026-90588

The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email...

PT-2026-90587

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...

PT-2026-90559

The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway...

PT-2026-90652

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1 Description The Bookmark plugin fails to validate user permissions, allowing unauthenticated attackers to read chapter names from password-protected videos. By queryi...

PT-2026-90566

Name of the Vulnerable Software and Affected Versions Gpx2Graphics WordPress plugin versions prior to 0.4 Description The plugin fails to perform a Cross-Site Request Forgery CSRF check during file upload operations and does not validate the type of uploaded files. This allows an attacker to tric...

PT-2026-90562

The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site ov...

PT-2026-90577

Name of the Vulnerable Software and Affected Versions Album Cover Finder versions prior to 0.7.1 Description The Album Cover Finder WordPress plugin fails to properly sanitize and escape the and action parameter before incorporating it into a SQL query. This flaw allows unauthenticated users to...

PT-2026-90560

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the...

PT-2026-90556

Name of the Vulnerable Software and Affected Versions Frontegg SAML SSO WordPress plugin versions prior to 1.0.2 Description The plugin fails to verify the signature or issuer of SAML authentication responses before establishing a session. This allows unauthenticated attackers to log in as any...

PT-2026-90780

Name of the Vulnerable Software and Affected Versions Notepad++ versions prior to 8.9.8 Description A stack buffer overflow exists in the plugin loading mechanism within the PluginsManager::loadPluginFromPath function. The issue occurs because the result of the GetLexerCount function, provided by...

@frontmcp/plugin-skilled-openapi (>=1.2.1, <=1.5.0-rc.1) potentially affected by CVE-2026-59973 via @frontmcp/adapters (>=1.2.1, <=1.5.0-rc.1)

@frontmcp/adapters NPM version =1.2.1, =1.2.1, =1.5.0-rc.1 Source cves: CVE-2026-59973 Source advisory: OSV:GHSA-65H7-9WRW-629C...

@frontmcp/adapters (>=1.0.4, <=1.5.0-rc.1), @frontmcp/plugin-skilled-openapi (>=0.0.1, <=1.5.0-rc.1) potentially affected by CVE-2026-39885 +1 more via mcp-from-openapi (>=2.3.0, <=2.4.0)

mcp-from-openapi NPM version =2.3.0, =1.0.4, =0.0.1, =1.5.0-rc.1 Source cves: CVE-2026-39885, CVE-2026-59973 Source advisory: GHSA-65H7-9WRW-629C...

@frontmcp/plugin-skilled-openapi (>=1.2.1, <=1.5.0-rc.1) potentially affected by CVE-2026-39885 +1 more via @frontmcp/adapters (>=1.2.1, <=1.5.0-rc.1)

@frontmcp/adapters NPM version =1.2.1, =1.2.1, =1.5.0-rc.1 Source cves: CVE-2026-39885, CVE-2026-59973 Source advisory: GHSA-65H7-9WRW-629C...

CVE-2024-25600

Exploit de CVE-2024-25600 - WordPress Bricks Builder Ejecución Remota de Código RCE Un script de exploit para CVE-2024-25600 , una vulnerabilidad crítica de Ejecución Remota de Código RCE sin autenticación en el plugin Bricks Builder para WordPress. Esta herramienta detecta la falla, extrae el...

WordPress The Events Calendar plugin <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution vulnerability

Unauthenticated PHP Object Injection to Remote Code Execution vulnerability discovered by Chloe Chamberland, Wordfence Argus in WordPress Plugin The Events Calendar versions = 6.17.4...