WordPress Powerkit – Supercharge your WordPress Site plugin <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Powerkit versions = 3.1.0...

WordPress Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.7.8.1...

WordPress Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Cozy Blocks versions = 2.2.11...

WordPress GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin GamiPress versions = 7.9.9.1...

CVE-2025-67650

An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks. This issue was fixed in the...

WordPress SendPulse Email Marketing Newsletter plugin <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin SendPulse Email Marketing Newsletter versions = 2.2.5...

EUVD-2026-51526

A SQL injection vulnerability has been identified in the PHP Jabbers - PHP Poll Script. Improper neutralization of input provided by user to pjAdminPolls.controller.php endpoint allows an authenticated attacker to perform SQL Injection attacks. This issue was fixed in version 4.1...

WordPress Plugin Organizer plugin <= 10.2.4 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by zhuxuan wu in WordPress Plugin Plugin Organizer versions = 10.2.4...

WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change vulnerability

Authenticated Subscriber+ PHP Object Injection to Arbitrary User Password Change vulnerability discovered by daroo in WordPress Plugin Fluent Forms Pro Add On Pack versions = 6.2.6...

WordPress Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin <= 5.0.9 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by NOn Nss in WordPress Plugin Taskbuilder versions = 5.0.9...

WordPress Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin <= 4.4.1 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Nia in WordPress Plugin Eazy Plugin Manager versions = 4.4.1...

CVE-2026-12357

The CVE-2026-12357 entry concerns Heimdall Data Database Proxy. The connected PT-2026-64200 source describes a CRLF injection in the generateFileContent() function, leading to remote code execution with root privileges. The vulnerability allows remote authenticated attackers to execute arbitrary ...

WordPress Improved Save Button plugin <= 1.2.1 - Authenticated (Author+) Second-Order SQL Injection vulnerability

Authenticated Author+ Second-Order SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Improved Save Button versions = 1.2.1...

CVE-2026-15992 WP Password Policy <= 3.7.1 - Authenticated (Subscriber+) Privilege Escalation

The WP Password Policy plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 3.7.1. This is due to missing authorization checks and nonce verification in the getuser function of the ModulePasswordHint class, which unconditionally calls WPUser::setrole with...

CVE-2026-66748 Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field

Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with customfields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the selecteval custom field type. Attackers can store an...

CVE-2026-66748

Camaleon CMS versions 2.1.1–2.9.1 are affected by an authenticated RCE via the select_eval custom field. Users with custom_fields manage permission can supply a Ruby expression that is stored in the field options and evaluated via instance_eval in an ERB view when a post edit page is rendered, en...

WordPress Newsletters plugin <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Newsletters versions = 4.15...

WordPress WowStore – Store Builder & Product Blocks for WooCommerce plugin <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin WowStore versions = 4.4.24...

WordPress WowStore – Store Builder & Product Blocks for WooCommerce plugin <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin WowStore versions = 4.4.24...

PT-2026-65518

Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with custom fields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the select eval custom field type. Attackers can store an...