WordPress Tutor LMS – eLearning and online course solution plugin <= 4.0.1 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Tutor LMS versions = 4.0.1...

EUVD-2026-49575

An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions. Successful exploitation may grant temporary platform administrator access...

WordPress SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin <= 3.9.7 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin SMS Alert Order Notifications versions = 3.9.7...

WordPress ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin <= 3.4.5 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin ShopLentor versions = 3.4.5...

CVE-2026-65707 Likeshop 3.0.5 Authenticated SQL Injection via adjustAccount Endpoint

Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting unsanitized POST parameters to the adjustAccount endpoint. The adjustAccount method in UserLogic.php concatenates the money, integral,...

WordPress AI Copilot – Content Generator plugin <= 1.5.4 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin AIWU versions = 1.5.4...

WordPress WP Foodbakery plugin <= 4.9 - Authenticated (Subscriber+) Arbitrary File Deletion vulnerability

Authenticated Subscriber+ Arbitrary File Deletion vulnerability discovered by Rafie Muhammad - Awesome Motive, Inc. in WordPress Plugin FoodBakery versions = 4.9...

WordPress SureDash – Community, Courses & Member Dashboard plugin <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin SureDash versions = 1.10.0...

WordPress Visualizer – Tables & Charts Manager with Built-in AI Generator plugin <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Visualizer versions = 4.0.5...

WordPress WP Hotel Booking plugin <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Hotel Booking versions = 2.3.2...

WordPress Tickera – Sell Tickets & Manage Events plugin <= 3.6.0.1 - Authenticated (Staff+) SQL Injection vulnerability

Authenticated Staff+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Tickera versions = 3.6.0.1...

WordPress Tickera – Sell Tickets & Manage Events plugin <= 3.6.0.1 - Authenticated (Staff+) SQL Injection vulnerability

Authenticated Staff+ SQL Injection vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Tickera versions = 3.6.0.1...

WordPress Grid/List View for WooCommerce plugin <= 3.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Grid List View for WooCommerce versions = 3.0.9...

WordPress Brands for WooCommerce plugin <= 3.8.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting vulnerability

Authenticated Shop Manager+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Brands for WooCommerce versions = 3.8.8...

CVE-2026-63454 Authenticated Path Traversal Vulnerability Leads to Remote Code Execution in AOS-CX

An authenticated path traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to copy arbitrary files to a user readable location from the command line interface of the underlying operating system, which could lead to remote code execution...

PT-2026-60811

An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 104997. The play file functionality accepts user-controlled input through the sound path parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying...

Rockwell Automation ThinManager

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an authenticated attacker to write arbitrary files to restricted system directories outside of the application's intended directory. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the...

CVE-2026-49876 Apache Gravitino: Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs

Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs. A vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 through 1.2.1. Users are recommended to upgrade to...

WordPress Avada (Fusion) Builder plugin <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Zbigniew Piotrak in WordPress Plugin Fusion Builder versions = 3.15.5...

CVE-2026-13262

CVE-2026-13262 affects the Majestic Support WordPress plugin (up to version 1.1.9). The issue is a generic SQL injection in the val parameter caused by insufficient escaping and lack of proper query preparation, allowing an attacker to append additional SQL to existing queries and potentially ext...