CVE-2026-97291: Deserialization of Untrusted Data

Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...

CVE-2026-96346: Improper Neutralization of Special Elements used in an SQL Command

Author SQL Injection in WP ERP = 1.17.9 versions...

CVE-2026-62085: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in WP Activity Log = 5.6.6 versions...

CVE-2026-16596: Improper Neutralization of Special Elements used in an SQL Command

The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'datafieldslist' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-91832: Improper Neutralization of Input During Web Page Generation

The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output...

PT-2026-103191

Author SQL Injection in WP ERP = 1.17.9 versions...

PT-2026-103157

Unauthenticated SQL Injection in WP Data Access = 5.5.84 versions...

PT-2026-103203

Unauthenticated Broken Access Control in WP Express Checkout Accept PayPal Payments = 2.4.9 versions...

PT-2026-103507

Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...

CVE-2026-93770: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WP Statistics = 14.16.13 versions...

PT-2026-103054

The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'data fields list' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-102386: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in WP Photo Album Plus = 9.3.02.003 versions...

PT-2026-103041

The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output...

CVE-2026-96825: Authentication Bypass by Spoofing

Subscriber Bypass Vulnerability in All In One WP Security & Firewall = 5.4.8 versions...

CVE-2026-96818: Missing Authorization

Unauthenticated Broken Access Control in WP Express Checkout Accept PayPal Payments = 2.4.9 versions...

CVE-2026-94681: Allocation of Resources Without Limits or Throttling

Unauthenticated Denial of Service Attack in WP Store Locator 3.0.0 versions...

CVE-2026-82127: Improper Neutralization of Input During Web Page Generation

The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher...

PT-2026-103100

Name of the Vulnerable Software and Affected Versions Real Estate Manager – Property Listing and Agent Management versions prior to 7.4 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access a...

WordPress WP Directory Kit plugin <= 1.5.4 - Authenticated (Custom+) SQL Injection vulnerability

Authenticated Custom+ SQL Injection vulnerability discovered by zickzick2 in WordPress Plugin WP Directory Kit versions = 1.5.4...

CVE-2026-8732-EXPLOIT

CVE-2026-8732 – WordPress WP Maps Pro Exploit 인증되지 않은 관리자 계정 탈취 | CVSS 9.8 | 즉시 사용 가능 🔥 제공 내용 CVE-2026-8732용 완전 작동 Python 익스플로잇 인증 없는 관리자 계정 생성 매직 로그인 URL 반환 – 즉시 사이트 장악 WP Maps Pro ≤ 6.1.0에서 작동 무흔적, 깔끔, 기본적으로 로그 미남김 ⚡ 왜 저희를 선택해야 하나요 50개 이상의 취약한 대상에서 테스트 완료 불필요한 코드 없음 – 순수 익스플로잇 레드 팀, 모의 침투, 버그...