14112 matches found
PT-2026-103739
The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noti token' parameter in all versions up to, and including, 1.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...
PT-2026-103737
Name of the Vulnerable Software and Affected Versions Super Forms – Drag & Drop Form Builder versions prior to 6.3.317 Description Authenticated users with Subscriber-level access and above can recursively delete arbitrary files and directories on the server, potentially leading to a full site...
PT-2026-103715
Name of the Vulnerable Software and Affected Versions ByteCoreStack – MCP Connector for AI Tools versions prior to 1.2.4 Description Authenticated users with Subscriber-level access or higher can elevate their privileges to Administrator. The issue exists in the execute tool function within the w...
PT-2026-103692
Name of the Vulnerable Software and Affected Versions Redux Framework versions prior to 4.5.15 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher...
PT-2026-103665
Name of the Vulnerable Software and Affected Versions Simply Schedule Appointments versions prior to 1.6.12.32 Description An Insecure Direct Object Reference IDOR exists due to missing validation on a user-controlled key. Authenticated attackers with subscriber-level access or higher can exploit...
PT-2026-103741
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...
CVE-2026-90972: Improper Access Control
The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync...
CVE-2026-89424: Improper Neutralization of Input During Web Page Generation
The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notitoken' parameter in all versions up to, and including, 1.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level acce...
CVE-2026-90992: Improper Neutralization of Input During Web Page Generation
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...
CVE-2026-97277: Missing Authorization
Subscriber Broken Access Control in Social Boost = 3.6.2 versions...
CVE-2026-97258: Missing Authorization
Subscriber Broken Access Control in Aruba Migration Tool = 1.0.4 versions...
CVE-2026-97297: Missing Authorization
Subscriber Broken Access Control in Gratisfaction = 4.6.3 versions...
CVE-2026-96268: Improper Neutralization of Input During Web Page Generation
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...
CVE-2026-101925: Improper Neutralization of Input During Web Page Generation
The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname via /wp-admin/profile.php + bbpreplycontent via bbPress reply form' parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This make...
CVE-2026-19807: Improper Privilege Management
The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the wpupdateusermeta MCP tool in executetool gating writes solely with currentusercan'edituser', $uid — a check that WordPress core'...
PT-2026-103744
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...
PT-2026-103732
The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display name via /wp-admin/profile.php + bbp reply content via bbPress reply form' parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This...
PT-2026-103877
Subscriber Privilege Escalation in ByteCoreStack MCP Connector for AI Tools = 1.2.2 versions...
