PT-2026-68645

Name of the Vulnerable Software and Affected Versions Easy Appointments WordPress plugin versions prior to 3.12.28 Description Insufficient validation of shortcode input occurs during a block-rendering action. The system only verifies the first tag of the provided string against an allowlist but...

PT-2026-68505

Name of the Vulnerable Software and Affected Versions Forminator versions prior to 1.57.0 Description An issue exists that allows a user with Contributor privileges to escalate their privileges within the system. Recommendations Update to a version newer than 1.56.0...

PT-2026-68588

Name of the Vulnerable Software and Affected Versions Ultimate Addons for Elementor versions prior to 1.45.3 Description Cross Site Scripting XSS allows an attacker with contributor privileges to execute malicious scripts in the browser of other users. This occurs when the application fails to...

PT-2026-68753

Name of the Vulnerable Software and Affected Versions DataPress Dataverse Integration WordPress plugin versions prior to 2.91 Description Insufficient access restrictions in the template rendering feature allow users with Contributor roles to disclose sensitive information. This issue occurs...

PT-2026-68404

Name of the Vulnerable Software and Affected Versions Child Pages Card WordPress plugin versions prior to 1.09 Description Insufficient sanitization and escaping of shortcode attributes before they are output on a page allows users with the contributor role and above to execute Stored Cross-Site...

CVE-2026-5336: Exposure of Sensitive Information to an Unauthorized Actor

The DataPress Dataverse Integration WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher...

CVE-2026-18395: Improper Neutralization of Input During Web Page Generation

The Child Pages Card WordPress plugin before 1.09 does not sanitise and escape some of its shortcode attributes before outputting them back in a page, allowing users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-5158: Improper Neutralization of Input During Web Page Generation

The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'inputPlaceHolder' parameter in all versions up to, and including, 5.0.13 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-5391: Improper Neutralization of Input During Web Page Generation

The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btnwrapperclasses' attribute of the 'latepointresources' shortcode in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping in the 'locations' branch of...

CVE-2026-16537: Improper Neutralization of Input During Web Page Generation

The Slick Slider WordPress plugin before 0.5.3 does not sanitize and escape a shortcode attribute value before outputting it in an HTML attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when a user views the affected post...

PT-2026-68514

Name of the Vulnerable Software and Affected Versions Powerkit versions prior to 3.1.1 Description Cross Site Scripting XSS allows an attacker to inject malicious scripts into web pages viewed by other users. In this case, the issue is specifically associated with the contributor role...

PT-2026-68510

Name of the Vulnerable Software and Affected Versions Unlimited Elements For Elementor Free Widgets, Addons, Templates versions prior to 2.0.15 Description A contributor can perform an arbitrary file download, allowing them to retrieve files from the server that they should not have access to...

PT-2026-68470

Name of the Vulnerable Software and Affected Versions PostX versions prior to 5.0.14 Description The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and outp...

PT-2026-68597

Name of the Vulnerable Software and Affected Versions MailOptin versions prior to 1.2.79.0 Description Cross Site Scripting XSS allows an attacker with contributor privileges to execute malicious scripts in the browser of other users. XSS is a security flaw where an application includes untrusted...

PT-2026-68471

Name of the Vulnerable Software and Affected Versions LatePoint versions prior to 5.3.3 Description Stored Cross-Site Scripting occurs when authenticated attackers with contributor level access or higher inject arbitrary web scripts into pages. This issue stems from insufficient input sanitizatio...

PT-2026-68593

Name of the Vulnerable Software and Affected Versions Gutenberg Blocks by Kadence Blocks versions prior to 3.7.9 Description An issue exists that allows for the exposure of sensitive data to users with contributor-level permissions. Recommendations Update Gutenberg Blocks by Kadence Blocks to...

CVE-2026-28111: Incorrect Privilege Assignment

Contributor Privilege Escalation in Forminator = 1.56.0 versions...

CVE-2025-15674: Incorrect Authorization

The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the editposts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of...

CVE-2026-14225: Improper Input Validation

The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire string, allowing users with contributor-level access to execu...

WP < 7.0.3 - Contributor+ Stored XSS via Emoji Settings Element

Description WordPress does not properly restrict the content of submitted posts in some cases, which could allow users with a role of Contributor and above to perform Stored Cross-Site Scripting attacks against users previewing the post...