CVE-2026-14321 Divi Dash < 1.0.7 - Unauthenticated Denial of Service via IP Address Spoofing

The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored...

EUVD-2026-85022

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings...

WordPress Real3D Flipbook plugin < 5.4 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Hanif Naufal Rahman in WordPress Plugin Real 3D FlipBook versions 5.4...

CVE-2026-18364 Zportals < 6.4.2 - Subscriber+ Arbitrary Plugin Settings Update

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings...

WordPress zportals plugin < 6.4.2 - Subscriber+ User Email Disclosure vulnerability

Subscriber+ User Email Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin Zportals versions 6.4.2...

EUVD-2026-85023

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on one of its AJAX actions, allowing users with a subscriber-level account to disclose the display name and email address of every registered user, including administrators...

WordPress zportals plugin < 6.4.2 - Subscriber+ Arbitrary Plugin Settings Update vulnerability

Subscriber+ Arbitrary Plugin Settings Update vulnerability discovered by Erwan LR WPScan in WordPress Plugin Zportals versions 6.4.2...

WordPress Social Commerce for WooCommerce plugin <= 2.5.4 - Unauthenticated Plugin Option and Product Sync Status Update vulnerability

Unauthenticated Plugin Option and Product Sync Status Update vulnerability discovered by Pablo González, Fran Ramirez and Iñigo Sánchez in WordPress Plugin Social Commerce for WooCommerce versions = 2.5.4...

Malicious code in eslint-plugin-i18n-shreddit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a22687900b0decfe83eda7516ec5c5169401894c98be27d115e5dffe64fc902 [email protected] ships no ESLint plugin code; the tarball's only function is a postinstall hook scripts.postinstall = 'node index.j...

MAL-2026-16437 Malicious code in eslint-plugin-i18n-shreddit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a22687900b0decfe83eda7516ec5c5169401894c98be27d115e5dffe64fc902 [email protected] ships no ESLint plugin code; the tarball's only function is a postinstall hook scripts.postinstall = 'node index.j...

Malicious code in @wizloft/harness-plugin-memory-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8f3c19162b88e3e800090cd1ebf21d351e27126fa964f4084286612b1637bb40 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @wizloft/harness-plugin-file-memory (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5791ca0cb9f6e9f35dbdec168cfa44f58498fe5559a99ba8d46dd5f28eff38c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @wizloft/harness-plugin-file-events (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f0ed60b35df86f2e566ba9ced2508d217d9dd009210bbf0e6cfea17520930ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16429 Malicious code in @wizloft/harness-plugin-file-events (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f0ed60b35df86f2e566ba9ced2508d217d9dd009210bbf0e6cfea17520930ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16430 Malicious code in @wizloft/harness-plugin-file-memory (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5791ca0cb9f6e9f35dbdec168cfa44f58498fe5559a99ba8d46dd5f28eff38c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16431 Malicious code in @wizloft/harness-plugin-memory-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8f3c19162b88e3e800090cd1ebf21d351e27126fa964f4084286612b1637bb40 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2026-97200

Name of the Vulnerable Software and Affected Versions Premium Packages WordPress plugin versions prior to 7.2.1 Description The plugin fails to verify the signature of webhooks received from PayPal when processing payment and subscription notifications. This allows unauthenticated attackers to...

CVE-2025-15696: Improper Neutralization of Input During Web Page Generation

The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the...

CVE-2026-6831: Missing Authorization

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

PT-2026-97197

Name of the Vulnerable Software and Affected Versions WC Fields Factory WordPress plugin versions prior to 4.1.11 Description Insufficient access restrictions and missing nonce verification for a post-cloning action allow users with Contributor-level permissions or higher to duplicate arbitrary...