CVE-2026-91010: Missing Authorization

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action, and only tests that a nonce parameter is present rather than validating it, allowing any authenticated user, such as a...

PT-2026-94158

Name of the Vulnerable Software and Affected Versions Dictionary WordPress plugin versions prior to 1.1 Description The plugin fails to escape user input before reflecting it in the responses of several directly accessible scripts. This allows unauthenticated attackers to execute Reflected...

PT-2026-94167

Name of the Vulnerable Software and Affected Versions Newsletter WordPress plugin versions prior to 9.3.8 Description The plugin fails to generate its email tracking signing key with sufficient entropy and utilizes an unkeyed hash to sign tracking links. This allows an unauthenticated attacker wh...

CVE-2026-87935: Unrestricted Upload of File with Dangerous Type

The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the adminrequesthandler function. This is due to missing authorization and file type validation in the adminrequesthandler function, which is reachable unauthenticated via...

PT-2026-94168

Name of the Vulnerable Software and Affected Versions Dewa Kirim versions prior to 1.0.1 Description The Dewa Kirim WordPress plugin fails to escape delivery coordinates submitted during the checkout process before they are output within an inline script. This allows unauthenticated users to...

PT-2026-94256

Name of the Vulnerable Software and Affected Versions Migratico Lite versions prior to 2.6.9 Description An unauthenticated remote code execution issue exists in the Migratico Lite plugin for WordPress. This flaw allows an attacker to perform full code injection without requiring authentication...

WordPress Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Custom Twitter Feeds Tweets Widget versions = 2.8.0...

PT-2026-95257

Name of the Vulnerable Software and Affected Versions WordPress versions 4.7 through 7.1 Description An unauthenticated stored cross-site scripting XSS issue, dubbed Comment2Shell, exists in the WordPress core. The flaw occurs in the wpautop function, which converts line breaks into paragraphs. A...

CVE-2026-89064: Insufficiently Protected Credentials

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...

CVE-2026-86824: Inadequate Encryption Strength

The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hash, allowing an unauthenticated attacker who recovers that key offline to forge tracking links, obtain any subscriber's session toke...

PT-2026-95063

Name of the Vulnerable Software and Affected Versions FaustWP versions prior to 1.8.11 Description The FaustWP WordPress plugin fails to include the 16-byte initialization vector in the HMAC Hash-based Message Authentication Code, a mechanism for verifying data integrity within the encrypt and...

CVE-2026-91009: Cross-Site Request Forgery (CSRF)

The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some of its AJAX actions, allowing any authenticated users, such as subscriber, to change the title of arbitrary posts, pages and products...

PT-2026-94170

Name of the Vulnerable Software and Affected Versions Dictionary WordPress plugin versions prior to 1.1 Description Lack of authorization, sanitization, and escaping when adding or updating dictionary entries allows unauthenticated users to perform a Stored Cross-Site Scripting XSS attack. This...

CVE-2026-16750: Missing Authorization

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvlajaxdealerloadcars function in all versions up to, and including, 1.4.120. This makes it possible for unauthenticated attackers to...

CVE-2026-91017: Insufficient Verification of Data Authenticity

The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders...

CVE-2026-87796: Unrestricted Upload of File with Dangerous Type

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the movefile function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated...

CVE-2026-86311: Improper Neutralization of Input During Web Page Generation

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

PT-2026-94138

Name of the Vulnerable Software and Affected Versions The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress versions prior to 1.8.45 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within the shortcode attributes...

CVE-2026-86709: Improper Authentication

The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication fails, allowing unauthenticated attackers to log in as any user, including administrators...

WordPress 7.0.0 < 7.1.1

WordPress versions 7.0.0 7.1.1 are affected by one or more vulnerabilities %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from WordPress Security Advisory wordpress-7-1-1-maintenance-and-security-release. include'compat.inc'; if descripti...