PT-2026-89772

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in as any registered user, including administrators, by supplying only that user's email address...

PT-2026-89774

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachments, allowing unauthenticated attackers to disclose other customers' order and attachment data...

PT-2026-89775

The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to creat...

PT-2026-89777

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowing any authenticated user such as a subscriber to tamper with the custom metadata of orders belongi...

PT-2026-89776

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output, allowing any authenticated user such as a subscriber to store JavaScript that executes ...

PT-2026-90662

Name of the Vulnerable Software and Affected Versions MemberPress Corporate Accounts versions prior to 1.5.40 Description An issue exists where authenticated attackers with subscriber-level access or higher who hold a corporate account can achieve privilege escalation. This occurs due to a mass...

WordPress Booking for Appointments and Events Calendar – Amelia plugin <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Nguyen Anh Quan prototw in WordPress Plugin Amelia versions = 2.4.9...

PT-2026-90593

Name of the Vulnerable Software and Affected Versions rtMedia for WordPress, BuddyPress and bbPress versions prior to 4.7.12 Description The plugin is subject to time-based blind SQL Injection, a technique where an attacker asks the database true/false questions and determines the answer based on...

PT-2026-90594

Name of the Vulnerable Software and Affected Versions Royal Addons for Elementor – Addons and Templates Kit for Elementor versions prior to 1.7.107 Description The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress allows unauthenticated attackers to extract...

PT-2026-89753

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.28.1 via the 's', 'post types', and 'orderby' request parameters. This is due to insufficient input sanitization and output escaping in the relevanssi debug...

CVE-2026-89240: Improper Neutralization of Input During Web Page Generation

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword.php. The script interpolates the unauthenticated GET parameter u which is not covered by $securityFilter directly into an attribute withou...

Vim ZIP Plugin Command Execution

The vulnerability in the built-in ZIP-plugin of the Vim text editor’s runtime/autoload/zip.vim module is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...

openSUSE 16 Security Update : waylyrics (openSUSE-SU-2026:21815-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21815-1 advisory. Changes in waylyrics: - Update to version 0.4.0 CVE-2026-25541 bsc1274106 Added plugin architecture and SakuraLLM translation plugin Added OpenCC suppor...

PT-2026-89788

The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts...

PT-2026-89836

The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature...

PT-2026-89859

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names are not encoded before being concatenated into public watch-page HTML. A video owner can inject malicious scripts via the bookmark name...

python3complete.vim Code Execution

The vulnerability of the PHP code autocompletion mechanism in the Python omni-completion module python3complete.vim text editor Vim is related to incorrect code generation management. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

PT-2026-89851

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is missing an authentication/authorization check in plugin/WebRTC/status.json.php. When the WebRTC plugin is present, any unauthenticated remote user can request /plugin/WebRTC/status.json.php and receive JSON containing the absolute...

PT-2026-89840

The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers to inject additional email headers, such as Bcc, into the emails the site sends when a submitted...

PT-2026-89785

The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above to permanently delete any chart on the site, including chart...