PT-2026-68850

Name of the Vulnerable Software and Affected Versions Stream plugin for WordPress versions prior to 4.2.1 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows authenticated attackers with...

PT-2026-68872

Name of the Vulnerable Software and Affected Versions WP Maps versions prior to 4.9.7 Description An issue exists where the plugin fails to perform a capability check in an AJAX action and does not properly validate a user-controlled path used in a file inclusion. This allows users with a...

CVE-2026-11907: Missing Authorization

The Stream plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2026-15991

The File Manager WordPress plugin (versions 6.0–6.9) is affected by an access control flaw in its elFinder integration. Insufficient file path validation in the connector allows an authenticated user with subscriber-level access or higher to read and delete arbitrary server files via a cmd parame...

PT-2026-68493

Name of the Vulnerable Software and Affected Versions UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress versions prior to 1.2.70 Description Stored Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping...

CVE-2025-9266: Missing Authorization

The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueuescripts function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to instal...

PT-2026-68558

Name of the Vulnerable Software and Affected Versions WP Job Portal versions prior to 2.5.7 Description An issue exists in the WP Job Portal plugin for WordPress due to insufficient escaping of user-supplied parameters and a lack of proper preparation of SQL queries. This allows authenticated...

PT-2026-68372

Name of the Vulnerable Software and Affected Versions File Manager for WordPress versions 6.0 through 6.9 Description Insufficient file path validation in the connector function allows authenticated attackers with subscriber-level access and above to read and delete arbitrary files on the server...

CVE-2026-65569: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in WP Job Portal = 2.5.6 versions...

CVE-2026-66711: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in WooCommerce Multilingual & Multicurrency = 5.5.6 versions...

CVE-2026-14306: Authorization Bypass Through User-Controlled Key

The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content...

CVE-2026-66470: Missing Authorization

Subscriber Broken Access Control in Frontend Admin by DynamiApps = 3.29.10 versions...

CVE-2026-15991: Missing Authorization

The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function in all versions from 6.0 - 6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to read and delete arbitrar...

CVE-2026-18501: Improper Neutralization of Input During Web Page Generation

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and including, 1.2.69 due to insufficient input sanitization and...

CVE-2026-65554: Missing Authorization

Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions...

CVE-2026-7456 Udimi Tools <= 3.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset via 'disconnect' AJAX Action

The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxdisconnect function in all versions up to, and including, 3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete...

CVE-2026-7456 Udimi Tools <= 3.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset via 'disconnect' AJAX Action

The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxdisconnect function in all versions up to, and including, 3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete...

CVE-2026-7520 MailChimp Forms by MailMunch <= 3.2.7 - Missing Authorization to Authenticated (Subscriber+) MailMunch Integration Takeover via 'sign_in' AJAX Action

The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the signin and signup AJAX handlers in all versions up to, and including, 3.2.7. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2026-7520

The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the signin and signup AJAX handlers in all versions up to, and including, 3.2.7. This makes it possible for authenticated attackers, with Subscriber-level...

PT-2026-68083

Name of the Vulnerable Software and Affected Versions MailChimp Forms by MailMunch versions prior to 3.2.8 Description The plugin is susceptible to unauthorized data modification because the sign in and sign up AJAX handlers lack proper capability checks. Authenticated users with Subscriber-level...