EUVD-2026-96456

Administrator SQL Injection in WP Ultimate CSV Importer = 9.2 versions...

react2shell-ultimate

React2Shell Ultimate Scanner v2.0 Scanner professionale per vulnerabilità RCE in Next.js RSC per CVE-2025-66478 🎯 Panoramica React2Shell Ultimate è uno scanner completo per vulnerabilità per CVE-2025-66478 — una vulnerabilità critica di Esecuzione Remota di Codice RCE che colpisce le applicazioni...

CVE-2026-4791

The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the logout-url shortcode's 'button' attribute in all versions up to, and including, 8.2.36 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

EUVD-2026-96300

The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the logout-url shortcode's 'button' attribute in all versions up to, and including, 8.2.36 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

CVE-2026-4791

The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 8.2.36 . The root cause is insufficient input sanitization and output escaping on user-supplied attributes within the logout-url shortcode's 'button'...

CVE-2026-4791 PeproDev Ultimate Profile Solutions <= 8.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Attribute

The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the logout-url shortcode's 'button' attribute in all versions up to, and including, 8.2.36 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

CVE-2026-104797

The Advanced Form Integration plugin for WordPress (versions up to and including 2.9.0 ) is vulnerable to an Authentication Bypass and Privilege Escalation . The flaw exists in the adfoin_ultimatememberac_send_data function, which handles the Ultimate Member "Update Profile Field" action. Because...

CVE-2026-4791: Improper Neutralization of Input During Web Page Generation

The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the logout-url shortcode's 'button' attribute in all versions up to, and including, 8.2.36 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

PT-2026-109787

Name of the Vulnerable Software and Affected Versions WP Ultimate CSV Importer versions prior to 9.3 Description An SQL Injection issue exists that allows an administrator to execute malicious SQL queries. This occurs when the application fails to properly sanitize input used in database queries...

CVE-2026-45440: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in WP Ultimate CSV Importer = 9.2 versions...

WordPress PeproDev Ultimate Profile Solutions plugin <= 8.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin PeproDev Ultimate Profile Solutions versions = 8.2.36...

WordPress Advanced Form Integration plugin <= 2.9.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action vulnerability

Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action vulnerability discovered by wachiss - Datafarm Co., Ltd. in WordPress Plugin Advanced Form Integration versions = 2.9.0...

CVE-2026-96539

Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1...

CVE-2026-96539 WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1...

EUVD-2026-95590

Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1...

CVE-2026-96539

The Ultimate Member WordPress plugin (versions

PT-2026-108860

Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1...

CVE-2026-96539: Incorrect Privilege Assignment

Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1...

CVE-2026-105886

Missing Authorization vulnerability in BdThemes Ultimate Post Kit ultimate-post-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Post Kit: from n/a through 4.5.5...

CVE-2026-105886 WordPress Ultimate Post Kit plugin <= 4.5.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in BdThemes Ultimate Post Kit ultimate-post-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Post Kit: from n/a through 4.5.5...