WordPress GeoDirectory plugin <= 2.8.149 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin GeoDirectory versions = 2.8.149...

WordPress Monetag Official Plugin plugin <= 1.1.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Monetag Official Plugin versions = 1.1.3...

CVE-2024-11976

The The BuddyPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 14.3.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

CVE-2025-14069

This CVE (CVE-2025-14069) affects Schema & Structured Data for WP & AMP (WordPress) up to version 1.54, via Stored Cross-Site Scripting in the saswp_custom_schema_field. Affected actor must have Contributor+ rights; exploitation would run scripts on pages when viewed by users. The Wordfence entry...

PT-2026-4429

Name of the Vulnerable Software and Affected Versions Livemesh Addons for WPBakery Page Builder versions through 3.9.4 Description The software contains a flaw related to improper input handling during web page creation, which can lead to Stored Cross-site Scripting XSS. This means that malicious...

PT-2026-4423

Name of the Vulnerable Software and Affected Versions Hyyan WooCommerce Polylang Integration versions through 1.5.0 Description A missing authorization issue exists in Hyyan WooCommerce Polylang Integration. The issue is due to incorrectly configured access control security levels, potentially...

PT-2026-4398

Name of the Vulnerable Software and Affected Versions ElementCamp versions prior to 2.3.3 Description An authorization issue exists in ElementCamp that allows exploitation of incorrectly configured access control security levels. Recommendations Update ElementCamp to a version later than 2.3.2...

PT-2026-4410

Name of the Vulnerable Software and Affected Versions WP Travel versions through 11.0.0 Description An authorization issue exists in WP Travel. The vulnerability allows exploitation of incorrectly configured access control security levels. Recommendations Update WP Travel to a version later than...

PT-2026-4389

Name of the Vulnerable Software and Affected Versions WP Term Order versions through 2.1.0 Description A Cross-Site Request Forgery CSRF issue exists in WP Term Order. This allows attackers to perform actions on behalf of authenticated users without their knowledge. Recommendations Update WP Term...

PT-2026-4374

Name of the Vulnerable Software and Affected Versions Essekia Tablesome versions through 1.1.35.2 Description An authorization issue exists in Essekia Tablesome, allowing exploitation due to incorrectly configured access control security levels. Recommendations Update Essekia Tablesome to a versi...

PT-2026-4450

Name of the Vulnerable Software and Affected Versions PopCash versions prior to 1.9 Description The PopCash Code Integration Tool has a flaw related to incorrectly configured access control security levels, potentially allowing unauthorized access. The tool is susceptible to missing authorization...

PT-2026-4440

Name of the Vulnerable Software and Affected Versions Bayarcash WooCommerce versions through 4.3.11 Description A missing authorization issue exists in Bayarcash WooCommerce bayarcash-wc, allowing exploitation of incorrectly configured access control security levels. Recommendations Update...

PT-2026-4442

Name of the Vulnerable Software and Affected Versions Elated-Themes Laurent Core versions through 2.4.1 Description The software contains a flaw related to improper control of filename handling for include/require statements, specifically a PHP Local File Inclusion issue. This allows for the...

PT-2026-4458

Name of the Vulnerable Software and Affected Versions Trusona for WordPress versions through 2.0.0 Description The software contains a missing authorization issue that allows exploitation of incorrectly configured access control security levels. Recommendations Update Trusona for WordPress to a...

PT-2026-4430

Name of the Vulnerable Software and Affected Versions Zoho CRM Lead Magnet versions through 1.8.1.5 Description An authorization issue exists in Zoho CRM Lead Magnet zoho-crm-forms, allowing exploitation of incorrectly configured access control security levels. Recommendations Update Zoho CRM Lea...

PT-2026-4426

Name of the Vulnerable Software and Affected Versions Cargus versions n/a through 1.5.8 Description A flaw exists in Cargus eCommerce Cargus that allows for the retrieval of embedded sensitive data due to insertion of sensitive information into sent data. Recommendations Update Cargus to a versio...

CVE-2026-24380

Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through = 4.2.8.0...

CVE-2026-24353

Missing Authorization vulnerability in wpeverest User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through = 4.4.9...

CVE-2026-22483

Cross-Site Request Forgery CSRF vulnerability in winkm89 teachPress teachpress allows Cross Site Request Forgery.This issue affects teachPress: from n/a through = 9.0.12...

CVE-2026-22382

Cross-Site Request Forgery CSRF vulnerability in Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme pawfriends allows Cross Site Request Forgery.This issue affects PawFriends - Pet Shop and Veterinary WordPress Theme: from n/a through = 1.3...