PT-2026-103192

Subscriber Insecure Direct Object References IDOR in Bookly = 28.2 versions...

PT-2026-103036

The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages an...

PT-2026-103205

Subscriber Cross Site Scripting XSS in Awesome Support = 6.3.9 versions...

PT-2026-103210

Subscriber Bypass Vulnerability in All In One WP Security & Firewall = 5.4.8 versions...

PT-2026-103234

Subscriber Cross Site Scripting XSS in JetEngine = 3.8.14.3 versions...

PT-2026-103252

Subscriber Cross Site Scripting XSS in CMB2 = 2.13.0 versions...

PT-2026-103239

Subscriber Broken Access Control in AllAble Connector = 0.13.4 versions...

PT-2026-103232

Subscriber Cross Site Scripting XSS in ThemeREX Addons 2.45.0 versions...

PT-2026-103229

Subscriber Insecure Direct Object References IDOR in Webba Booking = 6.5.0 versions...

PT-2026-103100

Name of the Vulnerable Software and Affected Versions Real Estate Manager – Property Listing and Agent Management versions prior to 7.4 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access a...

PT-2026-103099

Name of the Vulnerable Software and Affected Versions ReactPress – Create React App for WordPress versions prior to 3.4.1 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can...

PT-2026-103204

Subscriber Cross Site Scripting XSS in oik = 4.15.4 versions...

CVE-2026-89294: Improper Control of Filename for Include/Require Statement in PHP Program

The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssalocale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute...

WordPress ConvertPlus plugin <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection vulnerability

Authenticated Subscriber+ PHP Object Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin ConvertPlus versions = 3.6.3...

CVE-2026-87741

The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 3.6.3 via the style parameter of the cpdisplaypreviewmodal AJAX action. The vulnerability exists because the action's nonce guard is gated behind an isset check and fails...

CVE-2026-87741 ConvertPlus <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter

The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 3.6.3 via the style parameter of the cpdisplaypreviewmodal AJAX action. The vulnerability exists because the action's nonce guard is gated behind an isset check and fails...

EUVD-2026-88469

The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 3.6.3 via the style parameter of the cpdisplaypreviewmodal AJAX action. The vulnerability exists because the action's nonce guard is gated behind an isset check and fails...

CVE-2026-87741

The ConvertPlus plugin for WordPress is vulnerable to PHP Object Injection in versions up to and including 3.6.3 . The flaw exists in the cp_display_preview_modal AJAX action because the nonce guard fails open when the cp_admin_page_nonce parameter is omitted, and there is no capability check on ...

WordPress WP Review Slider Pro plugin < 12.7.12 - Subscriber+ Stored XSS vulnerability

Subscriber+ Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Review Slider Pro versions 12.7.12...

WordPress WP Review Slider Pro plugin < 12.7.12 - Subscriber+ Stored XSS vulnerability

Subscriber+ Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Review Slider Pro versions 12.7.12...