PT-2026-95789

Name of the Vulnerable Software and Affected Versions Redux Framework versions prior to 4.5.14 Description Stored Cross-Site Scripting occurs via Media field filter values. The issue stems from insufficient input sanitization of nested array values in the user meta save function and unsafe output...

CVE-2026-9766: Missing Authorization

The Empik for Woocommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-87909: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppaimagemagick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec, with only...

CVE-2026-5410: Improper Neutralization of Input During Web Page Generation

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in versions up to, and including, 4.5.13 This is due to insufficient input sanitization and output escaping. In the usermetasave function scalar values bypass the sanitization logic that on...

CVE-2026-1984: Missing Authorization

The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepausegteditor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with...

CVE-2026-9615: Missing Authorization

The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0. This is due to the licenseactivatefleximp and licensedeactivatefleximp functions, hooked to the wpajaxlicenseactivatefleximp and wpajaxlicensedeactivatefleximp AJAX actions,...

CVE-2026-15660: Missing Authorization

The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check on the handleoauthcallback function which is hooked to admininit and processes $GET'accesstoken' and $GET'googleemail' without verifying t...

PT-2026-95796

Name of the Vulnerable Software and Affected Versions Flex Import versions prior to 3.1 Description The plugin contains a missing authorization flaw. The license activate fleximp and license deactivate fleximp functions, which are linked to the wp ajax license activate fleximp and wp ajax license...

PT-2026-95777

Name of the Vulnerable Software and Affected Versions AppMySite – WordPress & WooCommerce Mobile App Builder versions prior to 3.15.4 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Subscriber-level access and...

PT-2026-95756

Name of the Vulnerable Software and Affected Versions Unbounce Landing Pages WordPress plugin versions prior to 1.1.5 Description An authorization bypass exists when updating the configuration used by the front-end proxy. This allows any authenticated user, including those with subscriber-level...

CVE-2026-5400: Improper Neutralization of Input During Web Page Generation

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media field filter values in versions up to, and including, 4.5.13 This is due to insufficient input sanitization of nested array values in the usermetasave function and unsafe output of filter CSS value...

CVE-2026-9613: Missing Authorization

The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

PT-2026-95782

Name of the Vulnerable Software and Affected Versions Metasync versions prior to 2.6.24 Description The Metasync plugin for WordPress allows unauthorized modification of data because the save instant indexing settings function lacks a capability check. The function is registered on the admin init...

PT-2026-95736

Name of the Vulnerable Software and Affected Versions SEO Booster versions prior to 7.4.8 Description The SEO Booster plugin for WordPress contains a missing authorization flaw. The handle oauth callback function, which is hooked to admin init, fails to perform a capability check when processing...

PT-2026-95781

Name of the Vulnerable Software and Affected Versions Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization versions prior to 2.6.24 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform...

PT-2026-95809

Name of the Vulnerable Software and Affected Versions Partial Shipment for Woocommerce versions prior to 3.5 Description Missing authorization in the plugin allows authenticated users with Subscriber-level access and above to access and modify order data. The issue exists within the...

PT-2026-95802

Name of the Vulnerable Software and Affected Versions Redux Framework versions prior to 4.5.14 Description Stored Cross-Site Scripting occurs via the spinner field due to insufficient input sanitization and output escaping. In the user meta save function, scalar values bypass sanitization logic...

PT-2026-95774

Name of the Vulnerable Software and Affected Versions BlockSpare versions prior to 4.2.7 Description The BlockSpare plugin for WordPress contains an authorization bypass flaw caused by incorrect logic within the permission callback. The issue stems from the use of an AND && operator instead of an...

PT-2026-95785

Name of the Vulnerable Software and Affected Versions VW Writer Blog theme for WordPress versions prior to 1.3.9 Description The software allows unauthorized modification of data because the vw writer blog reset all settings function lacks a proper capability check. Authenticated users with...

CVE-2026-13770: Improper Neutralization of Input During Web Page Generation

The AppMySite – WordPress & WooCommerce Mobile App Builder No-Code Android & iOS App Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via saveamslicensekey AJAX Handler in all versions up to, and including, 3.15.3 due to insufficient input sanitization and output escaping...