CVE-2026-87796: Unrestricted Upload of File with Dangerous Type

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the movefile function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated...

CVE-2026-89064: Insufficiently Protected Credentials

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...

PT-2026-94158

Name of the Vulnerable Software and Affected Versions Dictionary WordPress plugin versions prior to 1.1 Description The plugin fails to escape user input before reflecting it in the responses of several directly accessible scripts. This allows unauthenticated attackers to execute Reflected...

WordPress GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI plugin <= 2.34.6 - Unauthenticated Sensitive Information Exposure in Public Frontend Inline Script vulnerability

Unauthenticated Sensitive Information Exposure in Public Frontend Inline Script vulnerability discovered by Supakiad S. m3ez in WordPress Plugin GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites versions = 2.34.6...

WordPress Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Custom Twitter Feeds Tweets Widget versions = 2.8.0...

CVE-2026-92579 AVideo through 29.0 Broken Access Control via CSRF Exemption Basename Collision

In AVideo through 29.0, the autoCSRFGuard function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF exemptions. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionall...

WordPress Easy Invoice plugin <= 2.3.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rahul Yadav in WordPress Plugin Easy Invoice versions = 2.3.8...

WordPress Simple Membership plugin <= 4.8.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Simple Membership versions = 4.8.2...

WordPress Cooked plugin <= 1.16.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Nixxies in WordPress Plugin Cooked versions = 1.16.0...

WordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Booking Calendar versions = 11.7...

WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by benzdeus in WordPress Plugin PublishPress Series versions = 3.1.3...

WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by asdqgggg in WordPress Plugin User Registration versions = 5.2.7...

WordPress Xagio SEO plugin <= 7.1.0.43 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Matheo Beuve in WordPress Plugin Xagio SEO versions = 7.1.0.43...

WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by JunHee CHO in WordPress Plugin Geo Mashup versions = 1.13.21...

WordPress WPFunnels plugin <= 3.12.13 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Aditya Gurav in WordPress Plugin WPFunnels versions = 3.12.13...

WordPress BerqWP plugin <= 4.1.15 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by z3r0s in WordPress Plugin BerqWP versions = 4.1.15...

WordPress Multi Uploader for Gravity Forms plugin <= 1.1.9 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Adam Rayyan Aryasatya in WordPress Plugin Multi Uploader for Gravity Forms versions = 1.1.9...

WordPress Paid Downloads plugin <= 3.15 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Spy0x7 in WordPress Plugin Paid Downloads versions = 3.15...

WordPress GiveWP plugin 4.16.6-4.16.8.0 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Jakub Herman in WordPress Plugin GiveWP versions 4.16.6-4.16.8.0...

WordPress Ni WooCommerce Sales Report plugin < 4.2.0 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Erwan LR WPScan in WordPress Plugin Ni WooCommerce Sales Report versions 4.2.0...