PT-2026-88792

The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneo reward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

PT-2026-88880

The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...

VulnCheck KEV: CVE-2026-80099

Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the authenticate method — registered on the restauthenticationerrors filter and therefore evaluated for every unauthenticated REST API...

PT-2026-88789

The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec ajax save page default options AJAX handler iterating over every $ POST key and passing it directly into update option without any allowlist, while gating the...

PT-2026-89265

Name of the Vulnerable Software and Affected Versions Builderall Cheetah For Wp versions prior to 3.0.3 Description Unauthorized modification of data is possible due to a missing capability check in the disable function. The wp ajax ba cheetah disable AJAX handler is registered without capability...

PT-2026-88859

The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel the payment on any customer's booking...

PT-2026-88856

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a...

PT-2026-88855

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking...

WordPress WP Recipe Maker plugin <= 10.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Recipe Ownership Takeover and Unpublishing vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Recipe Maker versions = 10.8.0...

WordPress WP Crowdfunding plugin <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection vulnerability

Authenticated Shop Manager+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Crowdfunding versions = 2.2.1...

WordPress WP-Stateless plugin <= 4.4.1 - Settings Change vulnerability

Settings Change vulnerability discovered by Johan Buenavida in WordPress Plugin WP-Stateless versions = 4.4.1...

WordPress WP Travel plugin <= 12.0.3 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by CidKagenouSama in WordPress Plugin WP Travel versions = 12.0.3...

Exploit for CVE-2026-19949

CVE-2026-19949 — Prueba de concepto documentada y reproducible...

Exploit for CVE-2026-8732

CVE-2026-8732 — WP Maps Pro Unauthenticated Admin Creation E...

CVE-2026-81806

Server-Side Request Forgery SSRF vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. This issue affects Hide My WP Ghost: from n/a through 7.0.09...

CVE-2026-81806

CVE-2026-81806 is a Server-Side Request Forgery (SSRF) vulnerability in the WordPress Hide My WP Ghost plugin, affecting versions from unspecified through 7.0.09 . The flaw, disclosed by Patchstack , allows an unauthenticated, remote attacker (no user interaction required) to forge server-side re...

EUVD-2026-72652

Server-Side Request Forgery SSRF vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. This issue affects Hide My WP Ghost: from n/a through 7.0.09...

CVE-2026-81806 WordPress Hide My WP Ghost plugin <= 7.0.09 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. This issue affects Hide My WP Ghost: from n/a through 7.0.09...

CVE-2026-81806 WordPress Hide My WP Ghost plugin <= 7.0.09 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. This issue affects Hide My WP Ghost: from n/a through 7.0.09...

PT-2026-86998

Server-Side Request Forgery SSRF vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. This issue affects Hide My WP Ghost: from n/a through 7.0.09...