PT-2026-95809

Name of the Vulnerable Software and Affected Versions Partial Shipment for Woocommerce versions prior to 3.5 Description Missing authorization in the plugin allows authenticated users with Subscriber-level access and above to access and modify order data. The issue exists within the...

CVE-2026-2278: Missing Authorization

The VW Writer Blog theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'vwwriterblogresetallsettings' function in all versions up to, and including, 1.3.8. This makes it possible for authenticated attackers, with Subscriber-level access...

PT-2026-95808

Name of the Vulnerable Software and Affected Versions Empik for Woocommerce versions prior to 1.5.2 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or...

PT-2026-95736

Name of the Vulnerable Software and Affected Versions SEO Booster versions prior to 7.4.8 Description The SEO Booster plugin for WordPress contains a missing authorization flaw. The handle oauth callback function, which is hooked to admin init, fails to perform a capability check when processing...

PT-2026-95782

Name of the Vulnerable Software and Affected Versions Metasync versions prior to 2.6.24 Description The Metasync plugin for WordPress allows unauthorized modification of data because the save instant indexing settings function lacks a capability check. The function is registered on the admin init...

CVE-2026-5400: Improper Neutralization of Input During Web Page Generation

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media field filter values in versions up to, and including, 4.5.13 This is due to insufficient input sanitization of nested array values in the usermetasave function and unsafe output of filter CSS value...

PT-2026-95777

Name of the Vulnerable Software and Affected Versions AppMySite – WordPress & WooCommerce Mobile App Builder versions prior to 3.15.4 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Subscriber-level access and...

PT-2026-95789

Name of the Vulnerable Software and Affected Versions Redux Framework versions prior to 4.5.14 Description Stored Cross-Site Scripting occurs via Media field filter values. The issue stems from insufficient input sanitization of nested array values in the user meta save function and unsafe output...

CVE-2026-15660: Missing Authorization

The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check on the handleoauthcallback function which is hooked to admininit and processes $GET'accesstoken' and $GET'googleemail' without verifying t...

CVE-2026-9613: Missing Authorization

The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

CVE-2026-87909: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppaimagemagick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec, with only...

WordPress Partial Shipment for WooCommerce plugin <= 3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Settings Modification vulnerability discovered by Muhan Luo in WordPress Plugin Woocommerce Partial Shipment versions = 3.4...

WordPress Empik for Woocommerce plugin <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Product Meta Update vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Product Meta Update vulnerability discovered by Benedictus Jovan aillesiM in WordPress Plugin EmpikPlace for Woocommerce versions = 1.5.1...

WordPress Datalogics Ecommerce Delivery – Datalogics plugin <= 2.6.65 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Modification vulnerability discovered by Benedictus Jovan aillesiM in WordPress Plugin Datalogics Ecommerce Delivery versions = 2.6.65...

CVE-2026-12739

The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 4.5.0 . The root cause is that the plugin does not properly verify user authorization before performing actions. An authenticated attacker ...

WordPress WP Cloud Plugins - Dropbox (Out-of-the-Box) plugin 2.0-3.8.3 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

WordPress WP Cloud Plugins - Dropbox Out-of-the-Box plugin 2.0-3.8.3 - Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by WP Cloud Plugins in WordPress Plugin Out-of-the-Box versions 2.0-3.8.3...

CVE-2026-89413

The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-89138

The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-89413 Filter Gallery <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Deletion via 'ufg_gallery_id' Parameter

The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

EUVD-2026-82644

The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cssleft' parameter in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access a...