CVE-2026-9855 Custom Field Template <= 2.7.8 - Authenticated (Contributor+) SQL Injection via 'post_ID' Parameter

The Custom Field Template plugin for WordPress is vulnerable to generic SQL Injection via the 'postID' parameter in all versions up to, and including, 2.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-85658

ProfilePress (Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content) for WordPress is vulnerable to arbitrary shortcode execution in all versions up to and including 4.17.2 . The root cause is improper validation of a value before passing it to do_...

EUVD-2026-83556

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media field filter values in versions up to, and including, 4.5.13 This is due to insufficient input sanitization of nested array values in the usermetasave function and unsafe output of filter CSS value...

CVE-2026-84750 Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Field

The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary...

CVE-2026-84750

The Ultra Addons for Contact Form 7 WordPress plugin (versions 3.2.4-3.5.50 ) is vulnerable to an unauthenticated arbitrary file upload due to a lack of validation on file types and extensions in specific form fields. Attackers can upload files to a predictable public path with chosen extensions....

EUVD-2026-83472

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the uploadfile function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass...

CVE-2026-84434 Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the uploadfile function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass...

CVE-2026-84434

Gravity Forms (WordPress plugin) is vulnerable to unauthenticated arbitrary file upload in all versions up to and including 3.1.0.4 . The root cause is a mismatch between the field validation pipeline and the file persistence pipeline: hidden file upload fields bypass extension validation, and a ...

CVE-2026-76579: Improper Neutralization of Input During Web Page Generation

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

PT-2026-95738

Name of the Vulnerable Software and Affected Versions Gravity Forms versions prior to 3.1.1 Description An arbitrary file upload issue exists in the Gravity Forms plugin for WordPress via the upload file function. The flaw stems from a mismatch between the field validation pipeline and the file...

PT-2026-95789

Name of the Vulnerable Software and Affected Versions Redux Framework versions prior to 4.5.14 Description Stored Cross-Site Scripting occurs via Media field filter values. The issue stems from insufficient input sanitization of nested array values in the user meta save function and unsafe output...

PT-2026-95802

Name of the Vulnerable Software and Affected Versions Redux Framework versions prior to 4.5.14 Description Stored Cross-Site Scripting occurs via the spinner field due to insufficient input sanitization and output escaping. In the user meta save function, scalar values bypass sanitization logic...

CVE-2026-9855: Improper Neutralization of Special Elements used in an SQL Command

The Custom Field Template plugin for WordPress is vulnerable to generic SQL Injection via the 'postID' parameter in all versions up to, and including, 2.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

PT-2026-95798

Name of the Vulnerable Software and Affected Versions Custom Field Template versions prior to 2.7.9 Description Authenticated attackers with contributor-level access and above can perform a generic SQL Injection. This occurs because the post ID parameter is not sufficiently escaped and the SQL...

PT-2026-95752

Name of the Vulnerable Software and Affected Versions JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin versions prior to 3.6.5.3 Description Insufficient restriction of PHP functions used as custom field-validation callbacks allows users with form management privileges to trigger the...

PT-2026-95790

Name of the Vulnerable Software and Affected Versions WP Optimizer versions prior to 2.5.1 Description Authenticated attackers with administrator-level access can perform SQL Injection through the 's' parameter. The issue occurs in the parse key compare field function of the Query class, where a...

CVE-2026-5410: Improper Neutralization of Input During Web Page Generation

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in versions up to, and including, 4.5.13 This is due to insufficient input sanitization and output escaping. In the usermetasave function scalar values bypass the sanitization logic that on...

CVE-2026-63646

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, GET /mcp/form/config/formKey calls McpController.getMcpField without authentication because ShiroFilter.addPublicPathFilters marks /mcp/ as anonymous and the controller...

CVE-2026-93764

Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feature can therefore store values intended to be encrypted in readable form, with no error or warning. A party with routine read...

CVE-2026-65979

A flaw was found in OpenEXR's HTJ2K decoder. A local user could be tricked into opening a specially crafted EXR image file. When processed, the decoder reads beyond the bounds of an allocated buffer due to an unvalidated header length field. This out-of-bounds read can lead to a denial of service...