PT-2026-63944

Contributor Cross Site Scripting XSS in Smart SEO Tool = 4.1.2 versions...

PT-2026-63940

Unauthenticated Broken Access Control in Graphina = 3.1.12 versions...

PT-2026-63937

Contributor SQL Injection in Visualizer = 4.0.6 versions...

PT-2026-63855

Unauthenticated PHP Object Injection in Thrive Quiz Builder = 10.9.3.0 versions...

PT-2026-63828

Unauthenticated Cross Site Scripting XSS in Sprout Clients = 3.2.3 versions...

WordPress Tickera – Sell Tickets & Manage Events plugin <= 3.6.0.1 - Authenticated (Staff+) SQL Injection vulnerability

Authenticated Staff+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Tickera versions = 3.6.0.1...

WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability

WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme = 7.5.4 - Cross Site Scripting XSS vulnerability discovered by ed32.dll in WordPress Theme Manual - Documentation, Knowledge Base & Education WordPress Theme versions = 7.5.4...

WordPress eRoom plugin <= 1.7.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin eRoom versions = 1.7.1...

WordPress Ditty plugin <= 3.1.66 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Ditty versions = 3.1.66...

WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by daroo in WordPress Plugin uListing versions = 2.2.0...

WordPress Hubbub Lite plugin <= 1.36.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by zaim in WordPress Plugin Hubbub Lite versions = 1.36.3...

WordPress Ziina plugin <= 1.2.21 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Mitchell in WordPress Plugin Ziina versions = 1.2.21...

WordPress Participants Database plugin <= 2.7.8.3 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by hhhai in WordPress Plugin Participants Database versions = 2.7.8.3...

kernel: scsi: core: Wake up the error handler when final completions race against each other

Race condition vulnerabilities were found in the Linux kernel's SCSI error handler wake-up logic. Memory ordering issues in scsidechostbusy and ordering problems in scsiehinchostfailed can cause the SCSI error handler to never wake up when command completions race against each other. This leaves...

WordPress PayU India plugin <= 3.8.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin PayU India versions = 3.8.9...

WordPress Easy Digital Downloads plugin <= 3.6.7 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by James Paremain in WordPress Plugin Easy Digital Downloads versions = 3.6.7...

WordPress Avada Core plugin <= 5.15.6 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Luis Koleski in WordPress Plugin Avada Core versions = 5.15.6...

WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin MapSVG versions = 8.14.0...

CVE-2026-15802

The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'deletelocationsbackupfilecallback' function in all versions up to, and including, 4.9. This makes it possible for authenticated attackers, with subscriber-level access...

EUVD-2026-47419

Vulnerability in the Oracle Item Master product of Oracle E-Business Suite component: iSet-up bugs. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Item Master. Successful...