PT-2026-115533

Name of the Vulnerable Software and Affected Versions WP User Avatar / ProfilePress versions prior to 4.17.6 Description Authenticated users with Subscriber-level access and above can execute arbitrary shortcodes from any active plugin or theme. The issue occurs because the get user profile...

PT-2026-115525

Name of the Vulnerable Software and Affected Versions Social Share Buttons versions prior to 1.31 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This occurs via the share...

PT-2026-115449

Name of the Vulnerable Software and Affected Versions User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor versions prior to 4.0.4 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and...

PT-2026-115448

Name of the Vulnerable Software and Affected Versions Search Regex version 3.5 Description An issue exists where authenticated users with subscriber-level access and above can perform PHP Object Injection. This occurs through the deserialization of untrusted input within the replace all function...

PT-2026-115495

Name of the Vulnerable Software and Affected Versions Premium Packages – Sell Digital Products Securely versions prior to 7.2.9 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher...

PT-2026-115491

Name of the Vulnerable Software and Affected Versions HivePress – Business Directory, Listings & Classified Ads Plugin versions prior to 1.7.33 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored...

PT-2026-115524

Name of the Vulnerable Software and Affected Versions FiboSearch – Ajax Search for WooCommerce versions prior to 1.34.3 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This...

WordPress HivePress – Business Directory, Listings & Classified Ads Plugin plugin <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Sebastian Albrecht mySebbe in WordPress Plugin HivePress versions = 1.7.32...

WordPress Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin <= 4.11.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by Kuba in WordPress Plugin Slim SEO versions = 4.11.1...

WordPress Bulk Page Generator – LPagery plugin <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation/Modification/Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Page Creation/Modification/Deletion vulnerability discovered by Wordfence PRISM in WordPress Plugin Bulk Landing Page Creator for WordPress LPagery versions = 3.1.0...

WordPress Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin <= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML vulnerability

Authenticated Subscriber+ Sensitive Information Exposure in Admin Page HTML vulnerability discovered by crow in WordPress Plugin Image Hub Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy versions = 1.2.0...

EUVD-2026-101864

The Email Customizer for WooCommerce Pro plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the sendtestmail function, which allows user-controlled PHP code to be written to...

CVE-2026-81534

The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution (RCE) in versions up to and including 3.9.5 . The root cause is insufficient authorization and input sanitization within the send_test_mail() function, which allows for the injection of user-con...

CVE-2026-81534 Email Customizer for WooCommerce (Pro) <= 3.9.5 - Authenticated (Subscriber+) Remote Code Execution via 'template' Parameter

The Email Customizer for WooCommerce Pro plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the sendtestmail function, which allows user-controlled PHP code to be written to...

CVE-2026-17031

The Checkout Field Manager Checkout Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-17031 Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.9.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion via Checkout File Field Attachment ID

The Checkout Field Manager Checkout Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

EUVD-2026-101841

The Checkout Field Manager Checkout Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-17031

The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 7.9.6 . The root cause is the plugin's failure to properly verify user authorization when performing specific actions. This allows authen...

PT-2026-114799

The Email Customizer for WooCommerce Pro plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the send test mail function, which allows user-controlled PHP code to be written to...

CVE-2026-86461

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the checkmimetype function. This is due to incomplete file type validation in the checkmimetype function — while some extension checking is...