CVE-2026-91092 wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie

The wpForo Forum plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level acces...

CVE-2026-6922

The WP Table Builder – Drag & Drop Table Builder plugin for WordPress (all versions up to and including 2.2.1 ) contains an Incorrect Authorization flaw. The root cause is an operator precedence bug in the post-type guard within the trash_table_bulk() and restore_table_bulk() functions that cause...

CVE-2026-4123

The RW Elephant Rental Inventory WordPress plugin (all versions up to and including 2.3.13 ) is vulnerable to Missing Authorization in the toggle_cache() function hooked to the wp_ajax_toggle_cache AJAX action. The function lacks both a capability check and nonce verification , allowing any authe...

EUVD-2026-84300

The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13. This is due to a missing capability check on the togglecache function which is hooked to the wpajaxtogglecache AJAX action. The function also lacks nonce...

CVE-2026-75511: Server-Side Request Forgery (SSRF)

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.webhookUrl, then passes the selected endpoint.url through...

CVE-2025-1280: Improper Limitation of a Pathname to a Restricted Directory

The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 exclusive via the uxcbpagecustomizesavelayoutajax function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary...

CVE-2026-93343: Missing Authorization

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketkingadminvendorsajax AJAX action that allows authenticated attackers with subscriber-level access or higher to retrieve the complete vendor directory by sending a crafted AJAX request...

PT-2026-96732

Name of the Vulnerable Software and Affected Versions MarketKing plugin for WordPress versions prior to 2.1.72 Description An authorization flaw exists in the marketking send refund AJAX action. Authenticated users with subscriber-level access or higher can create fraudulent refund requests for a...

PT-2026-96760

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking get page content AJAX action that allows authenticated attackers with subscriber-level access or higher to access arbitrary vendor administrator panel pages by supplying an arbitrary...

PT-2026-96733

Name of the Vulnerable Software and Affected Versions MarketKing plugin for WordPress versions prior to 2.1.72 Description An authorization flaw exists in the marketking duplicate product AJAX action. Authenticated users with subscriber-level access or higher can duplicate any vendor's product by...

PT-2026-96665

Name of the Vulnerable Software and Affected Versions WP Table Builder – Drag & Drop Table Builder versions prior to 2.2.2 Description Incorrect Authorization exists due to an operator precedence bug in the post-type guard within the trash table bulk and restore table bulk functions, which preven...

CVE-2026-93344: Missing Authorization

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketkinggetpagecontent AJAX action that allows authenticated attackers with subscriber-level access or higher to access arbitrary vendor administrator panel pages by supplying an arbitrary vendor...

CVE-2026-93342: Missing Authorization

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketkingduplicateproduct AJAX action that allows authenticated attackers with subscriber-level access or higher to duplicate any vendor's product by supplying an arbitrary product ID. Attackers c...

CVE-2026-92235: Improper Control of Generation of Code

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible fo...

CVE-2026-91092: Missing Authorization

The wpForo Forum plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level acces...

CVE-2026-6922: Incorrect Authorization

The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.2.1. This is due to an operator precedence bug in the post-type guard within the trashtablebulk and restoretablebulk functions that causes the gua...

CVE-2026-4123: Missing Authorization

The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13. This is due to a missing capability check on the togglecache function which is hooked to the wpajaxtogglecache AJAX action. The function also lacks nonce...

PT-2026-96654

Name of the Vulnerable Software and Affected Versions BM Content Builder versions prior to 3.17.1 Description An issue exists where authenticated users with Subscriber-level access and above can perform Directory Traversal, a technique used to access files and directories that are stored outside...

PT-2026-96664

Name of the Vulnerable Software and Affected Versions RW Elephant Rental Inventory versions prior to 2.3.14 Description The plugin contains a missing authorization flaw. The toggle cache function, which is linked to the wp ajax toggle cache AJAX action, does not perform a capability check or nonc...

PT-2026-96676

Name of the Vulnerable Software and Affected Versions WP Ultimate Review versions prior to 2.4.3 Description Authenticated attackers with subscriber-level access and above can execute arbitrary shortcodes. This occurs because the software fails to properly validate a value before executing the do...