PT-2026-115424

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public mcs GET parameter is reflected into post content unsanitized before WordPress core's do shortcode filter runs, allowing an unauthenticated...

CVE-2026-19092: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output...