PT-2026-90784

Name of the Vulnerable Software and Affected Versions restify node-restify versions prior to 12.0.1 Description A remote path traversal flaw exists in the serveStatic function within the /lib/plugins/static.js library. Path traversal is a technique that allows an attacker to access files and...

PT-2026-90966

The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not verify payment completion with the configured payment gateway before marking an ad-selling order as paid, allowing users who can place an order to obtain a paid ad placement without payment...

PT-2026-90790

The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session check on one of its public AJAX actions, allowing unauthenticated users to read the submitted entries of any form created with a supported third-party form Conta...

PT-2026-90798

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to...

PT-2026-90964

Name of the Vulnerable Software and Affected Versions YouTube Embed versions 10.0 through 10.3 Description The plugin fails to perform authorization checks on an AJAX action, relying solely on a nonce printed on front-end pages. Additionally, it does not escape stored data before rendering, which...

PT-2026-90963

Name of the Vulnerable Software and Affected Versions Hoo Companion WordPress plugin version 1.0.2 Description An import feature lacks authorization and validation checks and fails to sanitize submitted data before storing it as the active theme settings. This allows unauthenticated attackers to...

CVE-2026-81648: Missing Authorization

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration an...

PT-2026-90965

The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing...

PT-2026-90962

Name of the Vulnerable Software and Affected Versions CryptoPayment Gateway versions 1.2.1 through 1.2.2 Description The plugin fails to apply an authorization check on an AJAX endpoint. This allows unauthenticated users to perform administrative operations, such as deleting arbitrary files on th...

PT-2026-90795

The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment button, allowing members to pay for a lower-priced membership while being granted a higher, more privileged...

PT-2026-90791

The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escala...

CVE-2026-88995: Exposure of Sensitive Information to an Unauthorized Actor

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request, allowing unauthenticated users to retrieve other customers' appointment details, including free-text booking comments and contact information...

PT-2026-90797

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request, allowing unauthenticated users to retrieve other customers' appointment details, including free-text booking comments and contact information...

CVE-2026-85129: Improper Neutralization of Input During Web Page Generation

The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which wi...

CVE-2026-90547

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the Bookmark plugin getBookmarks.json.php endpoint, allowing unauthenticated attackers to read chapter names from password-protected videos. Attackers can query the endpoint with a video ID...

CVE-2026-90543

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, with the Live plugin enabled, contains a missing authentication vulnerability in plugin/Live/socketMessageLiveOwner.json.php. The script reads the key and msg parameters from $REQUEST, resolves the stream owner via...

CVE-2026-10148

The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Elementor widgets in versions up to and including 2.4.9. This is due to insufficient input sanitization and output escaping on the 'loadmanually' parameter in the render...

CVE-2026-15451

The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the 'addsubaccountuser' function that passes the raw 'userdata' array to 'wpinsertuser' without filtering...

CVE-2026-15451

The MemberPress Corporate Accounts plugin for WordPress is affected by a privilege escalation vulnerability through mass assignment in versions up to and including 1.5.39 . The root cause lies in the add_sub_account_user function, which passes the raw userdata array to wp_insert_user without filt...

EUVD-2026-76875

The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the 'addsubaccountuser' function that passes the raw 'userdata' array to 'wpinsertuser' without filtering...