PT-2026-66366

Name of the Vulnerable Software and Affected Versions Frontend Admin versions prior to 3.29.7 Description Authenticated users with low privileges, such as Subscribers, can create, rename, and delete arbitrary taxonomy terms. This occurs because the plugin fails to perform necessary capability...

PT-2026-66389

Name of the Vulnerable Software and Affected Versions WP Real IP-based Access Control versions prior to 1.3.2 Description The plugin fails to perform capability or nonce checks before storing option values and does not escape these values on the settings page. This leads to Stored Cross-Site...

CVE-2026-12144

CVE-2026-12144 affects the Wholesale for WooCommerce plugin for WordPress (all versions up to and including 2.0.5). The root cause is in save_requests_meta(): the user_role_set POST parameter is sanitized only with sanitize_text_field(), then passed directly to WP_User::add_role() without an allo...

PT-2026-65687

The Survey Form Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get all data function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export...

CVE-2026-15304

The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'POpluginpath' parameter in versions up to, and including, 10.2.4. This is due to insufficient escaping on the user-supplied parameter in the performpluginsearch function, where escsql output is passed as the...

CVE-2026-16774

The CVE-2026-16774 entry concerns the WordPress Chatbot plugin vulnerable to Missing Authorization via the wpcs_send_email() AJAX handler in versions up to and including 8.5.9. The wpcs_send_email() function is registered for both wp_ajax_wpcs_send_email and wp_ajax_nopriv_wpcs_send_email without...

CVE-2026-58345

A flaw was found in Moodle. Insufficient capability checks in the Assignment module allowed users without the necessary permissions to allocate markers to submissions. This vulnerability could lead to unauthorized modification of assignment data, effectively granting a limited form of privilege...

CVE-2026-58348

A flaw was found in Moodle. Missing capability checks in the report builder fragment callbacks could allow authenticated users to retrieve report data that they are not authorized to access. This could lead to information disclosure...

CVE-2026-14821 Quiz And Survey Master < 11.1.5 - Contributor+ Arbitrary Template Deletion

The Quiz and Survey Master QSM WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete arbitrary templates...

PT-2026-65568

The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'PO plugin path' parameter in versions up to, and including, 10.2.4. This is due to insufficient escaping on the user-supplied parameter in the perform plugin search function, where esc sql output is passed as the...

PT-2026-65388

The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax function and the serveTemplatePdf REST route which is registered...

CVE-2026-12690

The ProfileGrid WordPress plugin in versions before 5.9.9.7 is vulnerable to Subscriber+ Premium License Tampering due to a missing authorization check. The plugin fails to perform a proper capability check on its license management actions, relying instead on a nonce that is exposed to any logge...

CVE-2026-1372

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the activatetutorfree and activateelementorfree functions registered as adminaction handlers. This makes it possible f...

CVE-2026-1372

The CVE concerns the WordPress plugins Tutor LMS Elementor Addons (

CVE-2026-1372 Tutor LMS Elementor Addons <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor Plugin Activation

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the activatetutorfree and activateelementorfree functions registered as adminaction handlers. This makes it possible f...

CVE-2026-1372 Tutor LMS Elementor Addons <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor Plugin Activation

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the activatetutorfree and activateelementorfree functions registered as adminaction handlers. This makes it possible f...

CVE-2026-14185 WPBot AI ChatBot < 8.2.0 - Subscriber+ RAG Settings Update

The WPBot WordPress plugin before 8.2.0 does not perform a capability or nonce check in one of its retrieval-augmented-generation settings handlers, allowing authenticated users with subscriber-level access to modify the WPBot WordPress plugin before 8.2.0's configuration...

CVE-2026-14185

The WPBot WordPress plugin before 8.2.0 does not perform a capability or nonce check in one of its retrieval-augmented-generation settings handlers, allowing authenticated users with subscriber-level access to modify the WPBot WordPress plugin before 8.2.0's configuration...

PT-2026-61838

The WPBot WordPress plugin before 8.2.0 does not perform a capability or nonce check in one of its retrieval-augmented-generation settings handlers, allowing authenticated users with subscriber-level access to modify the WPBot WordPress plugin before 8.2.0's configuration...

CVE-2026-63829

A flaw was found in the Linux kernel's IP Generic Routing Encapsulation ipgre component. This vulnerability allows a local attacker with network administration capabilities in one network namespace to modify a tunnel residing in a different network namespace where they lack privileges. This is du...