CVE-2026-85659

The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the updateccdetails AJAX handler forwards an attacker-supplied username parameter to ONTRAPORT via apicall'updateccdetails'...

CVE-2026-85659 PilotPress <= 2.0.43 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover via 'username' Parameter

The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the updateccdetails AJAX handler forwards an attacker-supplied username parameter to ONTRAPORT via apicall'updateccdetails'...

CVE-2026-85659

The PilotPress plugin for WordPress (versions up to and including 2.0.43 ) is vulnerable to Privilege Escalation via account takeover. The flaw exists in the update_cc_details() AJAX handler, which forwards an attacker-supplied username parameter to ONTRAPORT before performing a local collision c...

EUVD-2026-102680

The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the updateccdetails AJAX handler forwards an attacker-supplied username parameter to ONTRAPORT via apicall'updateccdetails'...

WordPress PilotPress plugin <= 2.0.43 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover via 'username' Parameter vulnerability

Authenticated Subscriber+ Privilege Escalation via Account Takeover via 'username' Parameter vulnerability discovered by Supakiad S. m3ez - E-CQURITY Thailand in WordPress Plugin PilotPress versions = 2.0.43...

EUVD-2025-30566

Malicious code in bioql PyPI...

EUVD-2024-21019

Malicious code in bioql PyPI...

EUVD-2025-30571

Malicious code in bioql PyPI...

CVE-2025-58221

Missing Authorization vulnerability in ONTRAPORT PilotPress pilotpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PilotPress: from n/a through = 2.0.36...

CVE-2025-58238

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ONTRAPORT PilotPress pilotpress allows Stored XSS.This issue affects PilotPress: from n/a through = 2.0.36...

CVE-2025-58238

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ONTRAPORT PilotPress pilotpress allows Stored XSS.This issue affects PilotPress: from n/a through = 2.0.36...

CVE-2025-58221

Missing Authorization vulnerability in ONTRAPORT PilotPress pilotpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PilotPress: from n/a through = 2.0.36...

WordPress PilotPress Plugin <= 2.0.36 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Nabil Irawan in WordPress Plugin PilotPress versions = 2.0.36...

WordPress PilotPress Plugin <= 2.0.36 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by zaim in WordPress Plugin PilotPress versions = 2.0.36...

CVE-2025-58221 WordPress PilotPress Plugin <= 2.0.36 - Broken Access Control Vulnerability

Missing Authorization vulnerability in ONTRAPORT PilotPress pilotpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PilotPress: from n/a through = 2.0.36...

CVE-2025-58221

CVE-2025-58221: PilotPress (Ontraport) WordPress plugin contains a Missing Authorization issue that permits an unauthenticated entity to perform an “arbitrary options update” via the wcmlim_settings_ajax_handler. This aligns with a network-scope vulnerability (CVSS v3.1: 4.3, Medium) and is assoc...

CVE-2025-58221 WordPress PilotPress Plugin <= 2.0.36 - Broken Access Control Vulnerability

Missing Authorization vulnerability in ONTRAPORT PilotPress pilotpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PilotPress: from n/a through = 2.0.36...

CVE-2025-58238 WordPress PilotPress Plugin <= 2.0.36 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ONTRAPORT PilotPress pilotpress allows Stored XSS.This issue affects PilotPress: from n/a through = 2.0.36...

CVE-2025-58238 WordPress PilotPress Plugin <= 2.0.36 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ONTRAPORT PilotPress pilotpress allows Stored XSS.This issue affects PilotPress: from n/a through = 2.0.36...

CVE-2025-58238

PilotPress (ONTRAPORT WordPress plugin) contains a Stored XSS in versions up to and including 2.0.36. The vulnerability is triggered when an authenticated attacker injects script via input that is not properly neutralized during web page generation. Effects are as described in Wordfence vulnerabi...