PT-2026-98888

Name of the Vulnerable Software and Affected Versions InvoicePlane version 1.7.2-beta-1 Description InvoicePlane fails to enforce email syntax for client email values and renders them unescaped within double-quoted value attributes in the invoice mailer and quote mailer forms. This allows an...

PT-2026-98397

Name of the Vulnerable Software and Affected Versions Repeater Fields for Elementor Forms versions prior to 2.2.8 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into...

PT-2026-98399

Name of the Vulnerable Software and Affected Versions User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor versions prior to 4.0.3 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site...

PT-2026-98389

Name of the Vulnerable Software and Affected Versions Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress versions prior to 9.6.1.1 Description An issue exists where the maybe update user role function reads a target role from a Gravity Forms entry field, configured via...

cve-2026-94504

cve-2026-94504 Ninja Forms unauth stored XSS POC Ninja Forms ≤ 3.15.3 — unauthenticated stored XSS. A public non-RTE textarea is saved, then htmlentitydecode'd and written into the legacy submission editor with no esctextarea. 3.15.4 escapes it. No login is required to plant the payload. It runs...

CVE-2026-3253

The MailerLite – Signup forms official plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with...

EUVD-2026-85854

The MailerLite – Signup forms official plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with...

CVE-2026-3253 MailerLite – Signup forms (official) <= 1.7.21 - Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion

The MailerLite – Signup forms official plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with...

CVE-2026-3253

The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data in versions up to and including 1.7.21 . The root cause is a missing capability check on the forms() method of the AdminController class. This vulnerability allows authenticated attack...

CVE-2026-3253 MailerLite – Signup forms (official) <= 1.7.21 - Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion

The MailerLite – Signup forms official plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with...

WordPress Forminator Forms plugin < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass vulnerability

Unauthenticated Poll Vote Limit Bypass vulnerability discovered by vuxvinh in WordPress Plugin Forminator versions 1.57.2.1...

CVE-2026-18467

The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3 patch introduced a wphash/hashequals signature gate on the pt-paytium-user-data field, but left a second filter — ptcfcheckoutmeta,...

CVE-2026-18467

The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation in versions up to and including 5.0.3 . The root cause is a logic flaw where the pt_cf_checkout_meta() filter copies $_POST['pt_form_field'][*] keys into the payment meta array...

EUVD-2026-85777

The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3 patch introduced a wphash/hashequals signature gate on the pt-paytium-user-data field, but left a second filter — ptcfcheckoutmeta,...

CVE-2026-18467 Paytium: Mollie payment forms & donations <= 5.0.3 - Unauthenticated Privilege Escalation via 'pt_form_field[pt-user-role]' Parameter

The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3 patch introduced a wphash/hashequals signature gate on the pt-paytium-user-data field, but left a second filter — ptcfcheckoutmeta,...

CVE-2026-18467 Paytium: Mollie payment forms & donations <= 5.0.3 - Unauthenticated Privilege Escalation via 'pt_form_field[pt-user-role]' Parameter

The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3 patch introduced a wphash/hashequals signature gate on the pt-paytium-user-data field, but left a second filter — ptcfcheckoutmeta,...

Exploit for CVE-2026-94504

cve-2026-94504 Ninja Forms unauth stored XSS POC Ninja Forms...

CVE-2026-3253: Missing Authorization

The MailerLite – Signup forms official plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with...

CVE-2026-84151: Improper Neutralization of Input During Web Page Generation

The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leadin...

PT-2026-97785

Name of the Vulnerable Software and Affected Versions MailerLite – Signup forms official plugin for WordPress versions prior to 1.7.22 Description An issue exists where a missing capability check in the forms method of the AdminController class allows authenticated users with Contributor-level...