CVE-2026-66649 WordPress Directory Pro plugin <= 2.5.8 - SQL Injection vulnerability

Unauthenticated SQL Injection in Directory Pro = 2.5.8 versions...

CVE-2026-66649

The WordPress Directory Pro plugin (versions ≤ 2.5.8) has an unauthenticated SQL injection vulnerability exploitable over the network with low complexity, scoring 9.3 critical. Patchstack advises upgrading to a patched version; no in-the-wild exploitation details are provided in the documents.

EUVD-2026-63302

Unauthenticated SQL Injection in Directory Pro = 2.5.8 versions...

EUVD-2026-63333

Author Local File Inclusion in WP Cafe Pro 3.0.15 versions...

CVE-2026-66586

WordPress WP Cafe Pro plugin (versions below 3.0.15) has a Local File Inclusion vulnerability, discovered by Ananda Dhakal of Patchstack. An authenticated author with high privileges can exploit it over the network to read sensitive server files, potentially compromising confidentiality, integrit...

CVE-2026-66586 WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability

Author Local File Inclusion in WP Cafe Pro 3.0.15 versions...

CVE-2026-66586 WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability

Author Local File Inclusion in WP Cafe Pro 3.0.15 versions...

WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Cafe Pro versions 3.0.15...

WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4.0 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Austin Ginder in WordPress Plugin Abandoned Cart Pro for WooCommerce versions = 10.4.0...

WordPress NotificationX Pro plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin NotificationX Pro versions = 3.1.4...

WordPress Amelia plugin 7.0-9.6 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Mustafa Ahmed in WordPress Plugin Amelia versions 7.0-9.6...

WordPress Directory Pro plugin <= 2.5.8 - SQL Injection vulnerability

SQL Injection vulnerability discovered by daroo in WordPress Plugin Directory Pro versions = 2.5.8...

Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code

Cybersecurity researchers have disclosed details of a critical flaw in the Elementor Pro WordPress plugin that, if successfully exploited, could lead to remote code execution. The vulnerability, tracked as CVE-2026-32475 , carries a CVSS score of 9.0 out of 10.0. It has been described as a case o...

PT-2026-78981

Unauthenticated Cross Site Scripting XSS in NotificationX Pro = 3.1.4 versions...

PT-2026-78975

Name of the Vulnerable Software and Affected Versions Directory Pro versions prior to 2.5.9 Description An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its database...

CVE-2026-66649: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Directory Pro = 2.5.8 versions...

CVE-2026-66586: Improper Control of Filename for Include/Require Statement in PHP Program

Author Local File Inclusion in WP Cafe Pro 3.0.15 versions...

PT-2026-78954

Author Local File Inclusion in WP Cafe Pro 3.0.15 versions...

PT-2026-78987

Unauthenticated Broken Authentication in User Registration & Membership Pro = 5.4.5 versions...

PT-2026-78980

Name of the Vulnerable Software and Affected Versions Abandoned Cart Pro for WooCommerce versions prior to 10.4.1 Description An issue allows unauthenticated users to perform privilege escalation. Recommendations Update Abandoned Cart Pro for WooCommerce to version 10.4.1 or later...