CVE-2026-78270 WordPress FluentCRM Pro plugin <= 3.1.12 - SQL Injection vulnerability

Author SQL Injection in FluentCRM Pro = 3.1.12 versions...

Authorization Bypass

Keycloak is vulnerable to an authorization bypass. The vulnerability is due to improper validation of the fullScopeAllowed field when it is omitted from a client registration or configuration request, which allows a delegated attacker to bypass the policy, create a client with full-scope access,...

Malicious Package

Overview twork-data-services-role-app is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

PT-2026-80812

Subscriber Broken Access Control in Fluent Support Pro = 2.3.1 versions...

PT-2026-80882

TIM Flow before 26.0.6 contains an improper authorization vulnerability that allows any authenticated user to submit arbitrary SQL queries to a privileged dashboard Excel export endpoint intended for administrative use only. Attackers can craft and submit unauthorized SQL queries to the export...

PT-2026-80831

Subscriber Broken Access Control in ProLancer Element = 1.4.8 versions...

PT-2026-80811

Author SQL Injection in FluentCRM Pro = 3.1.12 versions...

Exploit for CVE-2026-66917

IDOR + Stored XSS via Broken Object-Level Authorization in Joo...

CVE-2026-77003

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...

CVE-2026-77003 Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capability Bypass via create_new_content_mask

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...

CVE-2026-77003 Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capability Bypass via create_new_content_mask

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...

EUVD-2026-64637

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...

WordPress WooCommerce Bookings plugin < 3.9.0 - Subscriber+ Draft Bookable Product Creation vulnerability

Subscriber+ Draft Bookable Product Creation vulnerability discovered by Mike Gozdiskowski in WordPress Plugin WooCommerce Bookings versions 3.9.0...

CVE-2026-77003: Improper Privilege Management

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...

PT-2026-79759

Name of the Vulnerable Software and Affected Versions RestrictMate versions prior to 1.3.0 Description An issue exists where the plugin fails to restrict the user role provided during the account registration process. This allows unauthenticated attackers to specify an administrator role when...

PT-2026-79761

Name of the Vulnerable Software and Affected Versions Content Mask versions prior to 1.8.5.5 Description The Content Mask WordPress plugin fails to verify the necessary permissions required to publish the post type being created. This allows users with the Contributor role to publish posts and...

WordPress Post Duplicator plugin <= 3.0.11 - Authorization Bypass to Authenticated (Contributor+) Post Duplication vulnerability

Authorization Bypass to Authenticated Contributor+ Post Duplication vulnerability discovered by Quốc Huy jtwings in WordPress Plugin Post Duplicator versions = 3.0.11...

CVE-2026-19222

The Forminator Forms WordPress plugin before 1.57.0.7 does not consistently enforce the role restriction it applies to registration forms, allowing users who are permitted to build forms to configure one that assigns the administrator role to any visitor who registers through it...

CVE-2026-16260

The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in th...

EUVD-2026-64222

The Forminator Forms WordPress plugin before 1.57.0.7 does not consistently enforce the role restriction it applies to registration forms, allowing users who are permitted to build forms to configure one that assigns the administrator role to any visitor who registers through it...