PT-2026-72144

Name of the Vulnerable Software and Affected Versions 6Storage Rentals versions prior to 2.27.1 Description An authentication bypass exists that allows unauthenticated attackers to log in as any existing WordPress user, including administrators. The issue occurs because the six storage create wp...

SUSE CVE-2026-16241

Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lacking the mandatory prefix. The client overwrites a huge memory region with bytes outside attacker knowledge or control. This...

EUVD-2026-58738

An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their assigned scope...

EUVD-2026-58733

A SQL injection vulnerability exists in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries, potentially resulting in unauthorized access to sensitive data, including credentials...

CVE-2026-19628 Remote Code Execution

A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve arbitrary command execution on the underlying operating system when specific backend operations are triggered...

CVE-2026-72831 Grav through 2.0.11 Authentication Bypass via Flex Objects

The Flex Objects plugin through 1.4.6, tested with Grav 2.0.11 contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the...

EUVD-2026-58645

The Flex Objects plugin through 1.4.6, tested with Grav 2.0.11 contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the...

WordPress Bit Form plugin <= 3.2.0 - Authenticated (Administrator+) SQL Injection via 'filterText' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 'filterText' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Bit Form versions = 3.2.0...

WordPress affiliate-toolkit plugin <= 3.8.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 'orderby' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin affiliate-toolkit versions = 3.8.8...

CVE-2026-16810

The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'dataqueryCondition' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter...

CVE-2026-18039 Essential Addons for Elementor < 6.7.2 - Unauthenticated Privilege Escalation via Custom Profile Field Mass Assignment

The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom...

CVE-2026-14290

The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including...

CVE-2026-12743

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-12743

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...

EUVD-2026-58590

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-12743 affiliate-toolkit <= 3.8.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-16810

CVE-2026-16810 affects the Bit Form WordPress plugin up to version 3.2.0. The vulnerability is a generic SQL injection in the data[queryCondition] parameter caused by insufficient escaping and inadequate preparation of the existing SQL query. It requires authenticated access with administrator-le...

CVE-2026-16810 Bit Form <= 3.2.0 - Authenticated (Administrator+) SQL Injection via 'filterText' Parameter

The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'dataqueryCondition' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter...

CVE-2026-16810

The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'dataqueryCondition' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter...

CVE-2025-10308

The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing nonce validation on the options deletion functionality. This makes it possible for unauthenticated attackers to delete all plugin settings...