CVE-2026-59528

CVE-2026-59528 concerns the WordPress plugin ShipTime: Discounted Shipping Rates (versions

EUVD-2026-49204

Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates = 1.1.1 versions...

CVE-2026-59551: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...

CVE-2026-66442: Missing Authorization

Subscriber Broken Access Control in YayPricing = 3.5.6 versions...

PT-2026-64966

Subscriber Broken Access Control in YayPricing = 3.5.6 versions...

CVE-2026-59559: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg = 1.5.1 versions...

PT-2026-64946

Subscriber Broken Access Control in FundEngine = 1.7.8 versions...

PT-2026-64934

Subscriber Insecure Direct Object References IDOR in Paid Member Subscriptions = 3.0.7 versions...

CVE-2026-65434: Insertion of Sensitive Information Into Sent Data

Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce = 2.16.1 versions...

CVE-2026-65433: Missing Authorization

Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg = 1.5.1 versions...

PT-2026-64948

Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce = 2.16.1 versions...

PT-2026-64923

Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates = 1.1.1 versions...

PT-2026-64947

Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg = 1.5.1 versions...

PT-2026-64945

Subscriber Cross Site Scripting XSS in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg = 1.5.1 versions...

PT-2026-64935

Subscriber Broken Authentication in Hide My WP Ghost = 7.0.06 versions...

CVE-2026-15962

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The...

CVE-2026-15962

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The...

EUVD-2026-49047

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The...

PT-2026-64792

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The...

CVE-2026-15962: Deserialization of Untrusted Data

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The...