PT-2026-95753

Name of the Vulnerable Software and Affected Versions WP Import Export Lite WordPress plugin versions prior to 3.9.35 Description The plugin fails to verify if the user performing an import has the necessary permissions to create or modify user accounts and assign roles. This allows users with...

WordPress Hotel Booking Lite plugin < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint vulnerability

Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint vulnerability discovered by Haitam Lazaar in WordPress Plugin Hotel Booking Lite versions 6.2.3...

WordPress WPForms Lite plugin < 1.10.0.5 - Unauthenticated PayPal Webhook Forgery vulnerability

Unauthenticated PayPal Webhook Forgery vulnerability discovered by Sudhanshu Chauhan RedHunt Labs in WordPress Plugin Contact Form by WPForms versions 1.10.0.5...

CVE-2026-66628

Shop manager SQL Injection in WP-Lister Lite for eBay = 3.8.11 versions...

CVE-2026-62104

Unauthenticated Remote Code Execution RCE in Migratico Lite = 2.6.8 versions...

CVE-2026-66628 WordPress WP-Lister Lite for eBay plugin <= 3.8.11 - SQL Injection vulnerability

Shop manager SQL Injection in WP-Lister Lite for eBay = 3.8.11 versions...

CVE-2026-66628 WordPress WP-Lister Lite for eBay plugin <= 3.8.11 - SQL Injection vulnerability

Shop manager SQL Injection in WP-Lister Lite for eBay = 3.8.11 versions...

EUVD-2026-81509

Shop manager SQL Injection in WP-Lister Lite for eBay = 3.8.11 versions...

CVE-2026-66628

A SQL Injection vulnerability was identified in the shop manager functionality of the WordPress plugin WP-Lister Lite for eBay , affecting versions

CVE-2026-62104 WordPress Migratico Lite plugin <= 2.6.8 - Remote Code Execution (RCE) vulnerability

Unauthenticated Remote Code Execution RCE in Migratico Lite = 2.6.8 versions...

CVE-2026-62104

CVE-2026-62104 is an unauthenticated Remote Code Execution (RCE) vulnerability in the WordPress plugin Migratico Lite , affecting versions 2.6.8 and earlier . Discovered by Ananda Dhakal of Patchstack, the flaw allows a remote attacker with no prior access to execute arbitrary code on the host, r...

CVE-2026-62104 WordPress Migratico Lite plugin <= 2.6.8 - Remote Code Execution (RCE) vulnerability

Unauthenticated Remote Code Execution RCE in Migratico Lite = 2.6.8 versions...

EUVD-2026-81490

Unauthenticated Remote Code Execution RCE in Migratico Lite = 2.6.8 versions...

WordPress WP-Lister Lite for eBay plugin <= 3.8.11 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP-Lister Lite for eBay versions = 3.8.11...

CVE-2026-62104: Improper Control of Generation of Code

Unauthenticated Remote Code Execution RCE in Migratico Lite = 2.6.8 versions...

CVE-2026-66628: Improper Neutralization of Special Elements used in an SQL Command

Shop manager SQL Injection in WP-Lister Lite for eBay = 3.8.11 versions...

WordPress WP Import Export Lite plugin < 3.9.33 - Authenticated Arbitrary Directory Deletion vulnerability

Authenticated Arbitrary Directory Deletion vulnerability discovered by mak3breadMinseong Kim in WordPress Plugin WP Import Export Lite versions 3.9.33...

WordPress WP Import Export Lite plugin < 3.9.33 - Authenticated Arbitrary File Upload vulnerability

Authenticated Arbitrary File Upload vulnerability discovered by mak3breadMinseong Kim in WordPress Plugin WP Import Export Lite versions 3.9.33...

WordPress WP Import Export Lite plugin < 3.9.33 - Authenticated RCE vulnerability

Authenticated RCE vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Import Export Lite versions 3.9.33...

WordPress WP Import Export Lite plugin < 3.9.34 - Authenticated RCE vulnerability

Authenticated RCE vulnerability discovered by mak3breadMinseong Kim in WordPress Plugin WP Import Export Lite versions 3.9.34...