CVE-2026-32554: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in WooBeWoo Product Filter Pro = 3.1.8 versions...

CVE-2026-78272: Missing Authorization

Subscriber Broken Access Control in Fluent Support Pro = 2.3.1 versions...

PT-2026-80813

Subscriber Server Side Request Forgery SSRF in FluentCRM Pro = 3.1.12 versions...

VulnCheck KEV: CVE-2026-32558

Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress = 8.9.1 versions...

PT-2026-81046

Name of the Vulnerable Software and Affected Versions WooBeWoo Product Filter Pro versions prior to 3.1.9 Description An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes t...

PT-2026-80839

Unauthenticated Local File Inclusion in WP Cafe Pro 3.0.15 versions...

PT-2026-80811

Author SQL Injection in FluentCRM Pro = 3.1.12 versions...

PT-2026-80814

Subscriber Insecure Direct Object References IDOR in Fluent Boards Pro = 2.0.11 versions...

CVE-2026-32563: Deserialization of Untrusted Data

Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

CVE-2026-66585: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in WP Cafe Pro 3.0.15 versions...

CVE-2026-78277: Server-Side Request Forgery (SSRF)

Subscriber Server Side Request Forgery SSRF in FluentCRM Pro = 3.1.12 versions...

CVE-2026-78278: Authorization Bypass Through User-Controlled Key

Subscriber Insecure Direct Object References IDOR in Fluent Boards Pro = 2.0.11 versions...

CVE-2026-66587: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in WP Cafe Pro 3.0.15 versions...

PT-2026-80834

Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons = 2.2.0 versions...

PT-2026-80835

Subscriber SQL Injection in WP Project Manager Pro = 4.0.1 versions...

PT-2026-80833

Unauthenticated Cross Site Scripting XSS in Brave Conversion Engine PRO = 0.8.6 versions...

PT-2026-80837

Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress = 8.9.1 versions...

PT-2026-80838

Unauthenticated Sensitive Data Exposure in WP Cafe Pro 3.0.15 versions...

CVE-2026-76613

Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries...

CVE-2026-75115

Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files...