CVE-2026-6933

The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in versions up to and including 2.0. This is due to the 'generatePluginHandler' function lacking any authorization check before processing user-supplied POST data, combined with the...

CVE-2026-8443 WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'stypes' Parameter

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wpprogetoverallchartdata AJAX action in versions up to, and including, 12.6.8. This is due to the use of stripslashes on user-supplied JSON strings prior to jsondecode,...

PT-2026-50092

Subscriber Arbitrary Content Deletion in WPAMS 49.5.3 versions...

PT-2026-50080

Subscriber Arbitrary Content Deletion in Brikk = 3.0.0 versions...

EUVD-2026-36997

Subscriber Broken Access Control in myCred = 3.0.3 versions...

EUVD-2026-36991

Subscriber Broken Access Control in ChatBot = 7.9.7 versions...

EUVD-2026-36998

Subscriber Broken Access Control in Amelia = 2.2 versions...

EUVD-2026-36993

Subscriber Sensitive Data Exposure in WP SMS = 7.2.1 versions...

EUVD-2026-36982

Subscriber Broken Access Control in rtMedia for WordPress, BuddyPress and bbPress = 4.7.9 versions...

EUVD-2026-36996

Subscriber Broken Access Control in Groundhogg 4.4.1 versions...

EUVD-2026-36995

Subscriber Insecure Direct Object References IDOR in KiviCare = 4.2.1 versions...

EUVD-2026-36976

Subscriber SQL Injection in MasterStudy LMS = 3.7.25 versions...

EUVD-2026-36989

Subscriber Broken Authentication in AutomatorWP = 5.6.7 versions...

EUVD-2026-36959

Subscriber Arbitrary File Upload in WpStream 4.11.2 versions...

EUVD-2026-36964

Subscriber Cross Site Scripting XSS in Shipment Tracker for Woocommerce = 1.5.3.2 versions...

EUVD-2026-36969

Subscriber Arbitrary File Upload in WP-BusinessDirectory = 4.0.0 versions...

EUVD-2026-36970

Subscriber Broken Access Control in Ultra Addons for WPForms = 1.0.11 versions...

EUVD-2026-36929

Subscriber Broken Authentication in FunnelKit Automations = 3.7.3 versions...

EUVD-2026-36955

Subscriber Insecure Direct Object References IDOR in EventPrime = 4.3.0.0 versions...

EUVD-2026-36954

Subscriber Broken Access Control in Motors 1.4.107 versions...