CVE-2026-91077: Improper Access Control

The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event...

CVE-2026-6831: Missing Authorization

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

PT-2026-97177

Name of the Vulnerable Software and Affected Versions HappyAddons for Elementor versions prior to 3.50.0 Description An issue exists where an icon value in a button widget is not properly escaped before being output within an HTML attribute. This allows users with Contributor-level access or high...

PT-2026-97196

Name of the Vulnerable Software and Affected Versions The Event Booking Manager for WooCommerce versions prior to 5.7.3 Description The plugin fails to restrict its event listing query to events that the requesting user is authorized to view. Consequently, users with contributor-level access or...

CVE-2026-87981: Missing Authorization

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment...

EUVD-2026-84297

The Custom Field Template plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.8 via the editmetavalue due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access...

CVE-2026-88788

The Text Styler WordPress plugin (versions through 1.1.1 ) contains a Stored XSS vulnerability. The root cause is a failure to sanitize and escape user-supplied styling values before they are outputted within a front-end style block, combined with a lack of verification regarding a user's permiss...

CVE-2026-88788: Improper Neutralization of Input During Web Page Generation

The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling values before outputting them within a front-end style block, and does not verify that a user may edit the target post, allowing users with contributor-level access or above to store JavaScript that...

CVE-2026-9004: Exposure of Sensitive Information to an Unauthorized Actor

The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contactid' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract...

CVE-2026-16778: Improper Neutralization of Input During Web Page Generation

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslcmoduledownloadsoutput' Shortcode Content in all versions up to, and including, 2.1.21 due to insufficient input sanitization and output escaping. This makes it possible fo...

PT-2026-96661

Name of the Vulnerable Software and Affected Versions Live Composer – Free WordPress Website Builder versions prior to 2.1.22 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within the dslc module downloads output shortcode content...

PT-2026-96684

Name of the Vulnerable Software and Affected Versions WP Travel Engine – Tour Booking Plugin – Tour Operator Software versions prior to 6.8.1 Description The plugin contains a Local File Inclusion flaw, which occurs when an application includes a file without properly validating the input, allowi...

CVE-2026-8354

The Gum Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'poptag' parameter in all versions up to, and including, 1.3.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-83465

The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

PT-2026-95783

Name of the Vulnerable Software and Affected Versions Wow Elements Addons for Elementor versions prior to 1.11.3 Description This issue is a Server-Side Request Forgery, a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. Authenticated...

PT-2026-95786

Name of the Vulnerable Software and Affected Versions WP Composer – The Easiest Page Builder versions prior to 1.0.6 Description Stored Cross-Site Scripting occurs via the pbwp raw shortcode shortcode. The shortcode handler decodes Base64-encoded content and outputs it directly without sanitizati...

CVE-2026-9855: Improper Neutralization of Special Elements used in an SQL Command

The Custom Field Template plugin for WordPress is vulnerable to generic SQL Injection via the 'postID' parameter in all versions up to, and including, 2.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-2422: Improper Neutralization of Input During Web Page Generation

The WP Composer – The Easiest Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pbwprawshortcode' shortcode in all versions up to, and including, 1.0.5. This is due to the shortcode handler decoding Base64-encoded content and outputting it directly without an...

CVE-2026-15098: Improper Neutralization of Input During Web Page Generation

The Real3D Flipbook Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lightboxtext' shortcode attribute and other unsanitized attributes handled by onshortcode in versions up to, and including, 5.1.1. This is due to insufficient input sanitization and output escaping...

PT-2026-95798

Name of the Vulnerable Software and Affected Versions Custom Field Template versions prior to 2.7.9 Description Authenticated attackers with contributor-level access and above can perform a generic SQL Injection. This occurs because the post ID parameter is not sufficiently escaped and the SQL...