CVE-2026-85007: Unknown Video Player for YouTube: The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset…

The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset AJAX handler, allowing users with the Contributor role and above to read the site-wide player-preset configuration, and in versions before 2.1.1 to modify and delete it as well...

CVE-2026-118757

PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the updatefees AJAX handler that allows unauthenticated attackers to modify and read other customers' orders. Attackers can reuse a nonce from their own order-pay page...

CVE-2026-110509 Essential Addons for Elementor < 6.8.7 - Unauthenticated Private Post Meta Disclosure via load_more AJAX Handler

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query an unauthenticated visitor can pass to its pagination endpoint, which could allow them to read content of non-public post types and recover the values of private custom fields on publish...

CVE-2026-110509

The Essential Addons for Elementor WordPress plugin (versions before 6.8.7 ) is vulnerable to unauthorized data disclosure. The root cause is a failure to restrict the post type or meta query parameters passed by unauthenticated visitors to the plugin's pagination endpoint (specifically the load_...

CVE-2026-84999

The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the pieregfileupload function. This is due to the plugin performing file type validation via wpcheckfiletype and wpcheckfiletypeandext but never checking...

CVE-2026-111314

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atkpproductproducturl' parameter in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. This makes i...

EUVD-2026-111563

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atkpproductproducturl' parameter in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-111314 affiliate-toolkit <= 3.9.2 - Unauthenticated Stored Cross-Site Scripting via 'atkp_product_producturl' Parameter

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atkpproductproducturl' parameter in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-111314 affiliate-toolkit <= 3.9.2 - Unauthenticated Stored Cross-Site Scripting via 'atkp_product_producturl' Parameter

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atkpproductproducturl' parameter in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-84999

The Pie Register Premium plugin for WordPress (all versions up to and including 3.8.4.0 ) is vulnerable to Unrestricted File Type Upload via the piereg_file_upload function. The root cause is that the plugin performs validation using wp_check_filetype and wp_check_filetype_and_ext but fails to ch...

CVE-2026-111314: cservit affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display: The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Stored…

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atkpproductproducturl' parameter in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-118757: PI Websolution PiWeb Disable payment method / Partial payment for WooCommerce: PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization…

PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the updatefees AJAX handler that allows unauthenticated attackers to modify and read other customers' orders. Attackers can reuse a nonce from their own order-pay page...

Pie Register Premium arbitrary file upload vulnerability

Versions 3.8.4.0 and earlier of Pie Register Premium contain an arbitrary file upload vulnerability. This vulnerability arises because the pieregfileupload function fails to validate calls to file type checks, and the AJAX handler lacks nonce validation or permission checks. As a result,...

PT-2026-127792

Name of the Vulnerable Software and Affected Versions Pie Register Premium versions prior to 3.8.4.1 Description An unrestricted file type upload flaw exists in the piereg file upload function. The issue occurs because the plugin uses wp check filetype and wp check filetype and ext for validation...

PT-2026-129203

PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the update fees AJAX handler that allows unauthenticated attackers to modify and read other customers' orders. Attackers can reuse a nonce from their own order-pay page...

CVE-2026-113492 GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX Action

The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers, allowing unauthenticated users to disclose the content of non-public draft, pending and private listings by supplying their ID...

CVE-2026-114260

A vulnerability has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This vulnerability affects the function deletefolder of the file ajax.php of the component AJAX Handler. The manipulation of the argument ID leads to missing authentication. The...

CVE-2026-114260 oretnom23 file-management-system-php AJAX ajax.php delete_folder missing authentication

A vulnerability has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This vulnerability affects the function deletefolder of the file ajax.php of the component AJAX Handler. The manipulation of the argument ID leads to missing authentication. The...

CVE-2026-114260 oretnom23 file-management-system-php AJAX ajax.php delete_folder missing authentication

A vulnerability has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This vulnerability affects the function deletefolder of the file ajax.php of the component AJAX Handler. The manipulation of the argument ID leads to missing authentication. The...

CVE-2026-114260

The oretnom23 file-management-system-php (up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 ) contains a missing authentication vulnerability in the AJAX Handler component. Specifically, the delete_folder function within the ajax.php file fails to properly authenticate users when the ID argum...