PT-2026-96760

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking get page content AJAX action that allows authenticated attackers with subscriber-level access or higher to access arbitrary vendor administrator panel pages by supplying an arbitrary...

PT-2026-97032

Name of the Vulnerable Software and Affected Versions CMSimple version 5.24 Description CSRF protection is disabled by default, rendering the csrfProtection function ineffective for state-changing admin requests and omitting the csrf token hidden field in admin forms. Since administrator...

CVE-2026-75632: Uncontrolled Resource Consumption

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue...

PT-2026-96659

Name of the Vulnerable Software and Affected Versions Custom Field Template versions prior to 2.7.9 Description The plugin contains an Insecure Direct Object Reference IDOR flaw, which occurs when an application provides direct access to objects based on user-supplied input. The issue exists in t...

PT-2026-96715

Name of the Vulnerable Software and Affected Versions dgtlmoon changedetection.io versions prior to 0.60.8 Description A path traversal issue exists in the Screenshot Handler component within the static content function of the changedetectionio/flask app.py file. A remote attacker can exploit thi...

PT-2026-96937

Name of the Vulnerable Software and Affected Versions CAI Content Credentials affected versions not specified Description Improper input validation can lead to an application denial-of-service, allowing an attacker to crash the application. Exploitation requires user interaction, such as visiting...

PT-2026-96962

Name of the Vulnerable Software and Affected Versions CAI Content Credentials affected versions not specified Description An Integer Overflow or Wraparound issue exists, which can lead to an application denial-of-service. An attacker can cause the application to crash by inducing a victim to visi...

CVE-2025-1281: Improper Limitation of a Pathname to a Restricted Directory

The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uxcbremovelayoutajax and uxcbtoolsexportajax functions in all versions up to, and excluding, 3.17.1. This makes it possible for authenticated attackers, with...

PT-2026-96655

Name of the Vulnerable Software and Affected Versions BM Content Builder versions prior to 3.17.1 Description Insufficient file path validation in the ux cb remove layout ajax and ux cb tools export ajax functions allows authenticated attackers with Subscriber-level access and above to delete...

PT-2026-96654

Name of the Vulnerable Software and Affected Versions BM Content Builder versions prior to 3.17.1 Description An issue exists where authenticated users with Subscriber-level access and above can perform Directory Traversal, a technique used to access files and directories that are stored outside...

CVE-2026-89277: Integer Overflow or Wraparound

CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user...

CVE-2026-75633: Improper Input Validation

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user...

CVE-2025-1280: Improper Limitation of a Pathname to a Restricted Directory

The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 exclusive via the uxcbpagecustomizesavelayoutajax function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary...

PT-2026-96936

Name of the Vulnerable Software and Affected Versions CAI Content Credentials affected versions not specified Description An uncontrolled resource consumption issue exists in the Content Credentials SDK. A remote attacker can exploit this to exhaust system resources, leading to an application...

CVE-2026-88415

MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting XSS. The article content field contentDetails is excluded from the global XSS filter...

CVE-2026-88418

CMSimple 5.24 is vulnerable to persistent remote code execution because it ships with CSRF protection disabled by default. This flaw causes csrfProtection() to become a no-op on state-changing admin requests and omits the csrf_token hidden field in admin forms. An unauthenticated attacker can tri...

CVE-2026-75638: Improper Input Validation

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in...

CVE-2026-76194: Improper Input Validation

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue requires user...

CVE-2026-75634: Improper Input Validation

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue requires user...

PT-2026-96933

Name of the Vulnerable Software and Affected Versions CAI Content Credentials affected versions not specified Description An improper input validation issue exists that allows a remote attacker to bypass security features. This flaw can be leveraged to gain unauthorized write access without...