PT-2026-63847

Subscriber Broken Access Control in WP ERP = 1.17.5 versions...

PT-2026-63948

Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names = 1.3.3 versions...

PT-2026-63914

Subscriber PHP Object Injection in Dokan Pro = 5.0.2 versions...

PT-2026-63885

Subscriber Insecure Direct Object References IDOR in Masteriyo - LMS = 2.3.1 versions...

CVE-2026-13009: Improper Neutralization of Special Elements used in an SQL Command

The AI Copilot – Content Generator plugin for WordPress is vulnerable to generic SQL Injection via 'order0dir' Parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

CVE-2026-65494: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Dokan Pro = 5.0.2 versions...

PT-2026-63899

Subscriber Broken Access Control in ListingPro = 2.9.10 versions...

CVE-2026-57367: Missing Authorization

Subscriber Broken Access Control in WP Booking System 5.12.8.1 versions...

PT-2026-63820

Subscriber Broken Access Control in WP Booking System 5.12.8.1 versions...

PT-2026-63915

Subscriber SQL Injection in Dokan Pro = 5.0.2 versions...

CVE-2026-59543: Improper Control of Generation of Code

Subscriber Remote Code Execution RCE in Advanced Views = 3.8.11 versions...

PT-2026-63854

Subscriber Remote Code Execution RCE in Advanced Views = 3.8.11 versions...

PT-2026-63900

Subscriber Broken Access Control in Reviewer = 3.14.2 versions...

CVE-2026-27391: Missing Authorization

Subscriber Broken Access Control in uListing = 2.2.0 versions...

CVE-2026-65493: Deserialization of Untrusted Data

Subscriber PHP Object Injection in Dokan Pro = 5.0.2 versions...

CVE-2026-65491: Missing Authorization

Subscriber Broken Access Control in Query Wrangler = 1.5.57 versions...

CVE-2026-59542: Improper Limitation of a Pathname to a Restricted Directory

Subscriber Arbitrary File Deletion in Kali Forms = 2.4.18 versions...

CVE-2026-59513: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in Masteriyo - LMS = 2.3.0 versions...

CVE-2026-65478: Missing Authorization

Subscriber Broken Access Control in ListingPro = 2.9.10 versions...

CVE-2026-15017: Improper Privilege Management

The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8.4. This is due to missing capability checks and nonce verification in the MDJMPermissions::setpermissions and MDJMEmployeeManager::init functions, combined with the...