EUVD-2026-91247

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.6 via the 'otterformwidgetfilter' parameter. This makes it possible for authenticated attackers, with...

CVE-2026-79618

The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...

EUVD-2026-91176

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's beforeemailsuccessmsg function, in its registerloginaction='update' flow, trusting an attacker-supplied...

CVE-2026-19807

The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the wpupdateusermeta MCP tool in executetool gating writes solely with currentusercan'edituser', $uid — a check that WordPress core'...

CVE-2026-19807

The ByteCoreStack – MCP Connector for AI Tools WordPress plugin is vulnerable to Privilege Escalation in all versions up to and including 1.2.3 . The flaw exists in the wp_update_user_meta MCP tool within the execute_tool function, which improperly gates writes using current_user_can('edit_user',...

PT-2026-97707

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum...

PT-2026-97194

The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or...

PT-2024-15416

Name of the Vulnerable Software and Affected Versions Starbox plugin for WordPress versions up to, and including, 3.4.8 Description The issue is related to Stored Cross-Site Scripting via the Profile Display Name and Social Settings due to insufficient input sanitization and output escaping. This...

PT-2024-15005

Name of the Vulnerable Software and Affected Versions The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress versions up to, and including, 1.4.1.5 Description The issue is related to Stored Cross-Site Scripting via currency options due to insufficient input sanitization an...