PT-2026-115475

Name of the Vulnerable Software and Affected Versions Smush WordPress plugin versions prior to 4.3.4 Description An issue exists where changes to a network-wide access setting are not restricted to network administrators. This allows an administrator of a single site within a multisite network to...

PT-2026-115528

Name of the Vulnerable Software and Affected Versions SureDash versions prior to 1.12.1 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts into...

PT-2026-115500

Name of the Vulnerable Software and Affected Versions Wp Map Block versions prior to 3.0.1 Description The software contains a flaw allowing unauthorized data modification due to missing capability checks within the set status and bulk functions of the Maps Controller REST controller. The can edi...

PT-2026-115454

Name of the Vulnerable Software and Affected Versions NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar versions prior to 3.3.4 Description Stored Cross-Site Scripting occurs due to insufficient input...

PT-2026-115468

Name of the Vulnerable Software and Affected Versions Visual Form Builder versions prior to 3.2 Description The plugin fails to perform authorization or nonce checks when reordering form fields. This allows any authenticated user with the Subscriber role or higher to modify the field structure of...

PT-2026-115469

Name of the Vulnerable Software and Affected Versions Visual Form Builder WordPress plugin versions prior to 3.2 Description The plugin fails to perform an authorization check before displaying recent form submission data within a dashboard widget. This allows any authenticated user with the...

PT-2026-115494

Name of the Vulnerable Software and Affected Versions WebberZone Top 10 — Popular Posts versions prior to 4.5.3 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. By setting...

VulnCheck KEV: CVE-2026-104736

The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitizetextfield, which does not stri...

PT-2026-115481

Name of the Vulnerable Software and Affected Versions WX Subscribe 微信支付付费订阅 WordPress plugin versions prior to 1.2.2 Description An issue exists where a parameter is not properly sanitized and escaped before being used in a SQL statement. This allows unauthenticated attackers to perform SQL...

PT-2026-115536

Name of the Vulnerable Software and Affected Versions DoubleScale | All-in-One CRM versions prior to 1.5.2 Description An arbitrary file upload issue exists in the store upload function. The flaw stems from a fail-open extension allow-list in the extension is allowed function, which returns true...

PT-2026-115542

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.1.1 Description The Tutor LMS plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Authenticated users with subscriber-level access or...

PT-2026-115576

Name of the Vulnerable Software and Affected Versions GoSMTP Pro versions prior to 1.2.4 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS. This occurs because WordPress comment kses does not strip...

PT-2026-115534

Name of the Vulnerable Software and Affected Versions Name Directory versions prior to 1.34.3 Description The Name Directory plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Authenticated attackers with...

PT-2026-115533

Name of the Vulnerable Software and Affected Versions WP User Avatar / ProfilePress versions prior to 4.17.6 Description Authenticated users with Subscriber-level access and above can execute arbitrary shortcodes from any active plugin or theme. The issue occurs because the get user profile...

PT-2026-115535

Name of the Vulnerable Software and Affected Versions SureCart versions prior to 4.9.5 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts via the comment parameter. These scripts...

PT-2026-115573

Name of the Vulnerable Software and Affected Versions Events Made Easy versions prior to 3.2.23 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user...

PT-2026-115432

Name of the Vulnerable Software and Affected Versions MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. versions prior to 1.2.78.7 Description An unauthenticated privilege escalation issue exists because the subscribe to email list endpoint accepts an...

PT-2026-115443

Name of the Vulnerable Software and Affected Versions ELEX WordPress HelpDesk & Customer Ticketing System versions prior to 3.3.8 Description Insufficient file type validation occurs when saving IMAP email attachments through the initMailPart function. This allows unauthenticated attackers to...

PT-2026-115441

Name of the Vulnerable Software and Affected Versions User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor versions prior to 4.0.4 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site...

PT-2026-115487

Name of the Vulnerable Software and Affected Versions TranslatePress – Translate Multilingual sites with AI Translation versions prior to 3.3.8 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary...