WordPress Masteriyo LMS plugin <= 2.2.0 - Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion vulnerability discovered by Jamshed Yergashvoyev CVE Guy - Turan Security in WordPress Plugin Masteriyo - LMS versions = 2.2.0...

WordPress Powerkit plugin <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Processing vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Lazy Load Image Processing vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Powerkit versions = 3.0.4...

WordPress SEO Flow by LupsOnline plugin 3.0.0-3.0.2 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Naoki Kawahigashi in WordPress Plugin SEO Flow by LupsOnline versions 3.0.0-3.0.2...

CVE-2026-8279: Missing Authorization

The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'deleteitempermissionscheck' function in the CourseProgressItemsController in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers ...

CVE-2026-6431: Improper Neutralization of Input During Web Page Generation

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and...

CVE-2026-12853: Missing Authorization

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

CVE-2026-2390: Improper Neutralization of Input During Web Page Generation

The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'contentprocessimages' function using a flawed regex-based HTML attribute parser. This makes it possible for...

PT-2026-86804

The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...

The vulnerability of the copy_post_image() function in the Gravity Forms plugin of the WordPress content management system allows a hacker to upload arbitrary files and execute arbitrary code.

The vulnerability of the copypostimage function in the Gravity Forms plugin of the WordPress content management system is related to the ability to upload unlimited dangerous files. Exploiting this vulnerability allows a malicious actor to upload any files and execute any code...

PT-2026-86803

The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that do...

PT-2026-86751

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

CVE-2026-12757: Improper Control of Generation of Code

The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that do...

PT-2026-86756

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and...

PT-2026-86762

The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'delete item permissions check' function in the CourseProgressItemsController in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attacke...

WordPress Zephyr Project Manager plugin <= 3.3.205 - Authenticated (Custom+) Stored Cross-Site Scripting vulnerability

Authenticated Custom+ Stored Cross-Site Scripting vulnerability discovered by Nabil Irawan in WordPress Plugin Zephyr Project Manager versions = 3.3.205...

PT-2026-86682

The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'content process images' function using a flawed regex-based HTML attribute parser. This makes it possible for...

CVE-2026-4945: Authorization Bypass Through User-Controlled Key

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watchcheckout' function due to missing validation on a user controlled key. This makes it possib...

WordPress Online Scheduling and Appointment Booking System – Bookly plugin <= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update vulnerability

Missing Authorization to Authenticated Subscriber+ Limited Arbitrary Plugin Update vulnerability discovered by KoreaInfoSec in WordPress Plugin Bookly versions = 27.2...

CVE-2026-14444: Improper Privilege Management

The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...

PT-2026-86752

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watch checkout' function due to missing validation on a user controlled key. This makes it...