PT-2026-104108

The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...

PT-2026-104118

Name of the Vulnerable Software and Affected Versions Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE versions prior to 3.2.7 Description An issue exists that allows authenticated attackers with subscriber-level access and above to expose sensitive information. By utilizi...

PT-2026-104090

The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including...

PT-2026-104078

Name of the Vulnerable Software and Affected Versions Super Forms – Drag & Drop Form Builder versions prior to 6.3.317 Description An issue exists in the Register & Login add-on where the before email success msg function, during the register login action='update' flow, trusts a user-supplied use...

PT-2026-104149

Name of the Vulnerable Software and Affected Versions Download Manager versions prior to 3.3.71 Description The Download Manager plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Authenticated users with subscriber-lev...

CVE-2026-96268

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

CVE-2026-89424

The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notitoken' parameter in all versions up to, and including, 1.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level acce...

CVE-2026-101925

The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname via /wp-admin/profile.php + bbpreplycontent via bbPress reply form' parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This make...

CVE-2026-89424 Duplicate Post <= 1.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'noti_token' Parameter

The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notitoken' parameter in all versions up to, and including, 1.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level acce...

CVE-2026-89424 Duplicate Post <= 1.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'noti_token' Parameter

The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notitoken' parameter in all versions up to, and including, 1.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level acce...

CVE-2026-89424

The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.5.6 . The root cause is insufficient input sanitization and output escaping involving the 'noti_token' parameter. An authenticated attacker with Subscriber-level access (or...

EUVD-2026-90573

The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notitoken' parameter in all versions up to, and including, 1.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level acce...

CVE-2026-96268 Awesome Support <= 6.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'gdpr-data' Parameter via wpas_gdpr_user_opt_out AJAX Action

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

EUVD-2026-90569

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

CVE-2026-96268 Awesome Support <= 6.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'gdpr-data' Parameter via wpas_gdpr_user_opt_out AJAX Action

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

CVE-2026-96268

The Awesome Support – WordPress HelpDesk & Support Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 6.4.0 . The root cause is insufficient input sanitization and output escaping of the 'gdpr-data' parameter within the wpas_gdpr_user_opt_o...

EUVD-2026-90567

The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname via /wp-admin/profile.php + bbpreplycontent via bbPress reply form' parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This make...

CVE-2026-101925 bbp style pack <= 6.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Author Display Name

The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname via /wp-admin/profile.php + bbpreplycontent via bbPress reply form' parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This make...

CVE-2026-101925 bbp style pack <= 6.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Author Display Name

The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname via /wp-admin/profile.php + bbpreplycontent via bbPress reply form' parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This make...

CVE-2026-101925

The bbp style pack plugin for WordPress (versions up to and including 6.4.8 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the display_name (via /wp-admin/profile.php) and bbp_reply_content (via bbPress reply form) p...