PT-2026-98372

Name of the Vulnerable Software and Affected Versions HT Contact Form – Drag & Drop Form Builder for WordPress versions prior to 2.10.2 Description Insufficient input sanitization and output escaping in the form data Rich Text Field allow unauthenticated attackers to perform Stored DOM-Based...

CVE-2026-93303: Improper Neutralization of Input During Web Page Generation

The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'formdata' Rich Text Field via Draft Save/Resume in all versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. Th...

CVE-2026-88929

The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin before 7.5.2 does not check whether a product is published before returning its details to unauthenticated users, allowing them to read the title, description and price of draft, pending and private products...

CVE-2026-87074

The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its...

CVE-2026-88929

The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin (versions 7.0.0-7.5.1 ) is vulnerable to an unauthenticated non-public product disclosure . The flaw exists because the plugin fails to verify if a product is published before returning its details to unauthenticated users...

CVE-2026-88929 Sale Booster 7.0.0 - 7.5.1 - Unauthenticated Non-Public Product Disclosure

The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin before 7.5.2 does not check whether a product is published before returning its details to unauthenticated users, allowing them to read the title, description and price of draft, pending and private products...

CVE-2026-88929 Sale Booster 7.0.0 - 7.5.1 - Unauthenticated Non-Public Product Disclosure

The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin before 7.5.2 does not check whether a product is published before returning its details to unauthenticated users, allowing them to read the title, description and price of draft, pending and private products...

EUVD-2026-85048

The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its...

CVE-2026-87074 Forminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link

The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its...

CVE-2026-87074

The Forminator Forms WordPress plugin (versions 1.17.1 through 1.57.2.0 ) is vulnerable to unauthenticated arbitrary recipient email sending. The root cause is a failure to bind saved-draft notifications to the original visitor, allowing the plugin to accept the recipient address and message link...

CVE-2026-87074 Forminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link

The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its...

WordPress WP Recipe Maker plugin 10.3.0-10.8.1 - Subscriber+ Draft and Private Recipe Content Disclosure vulnerability

Subscriber+ Draft and Private Recipe Content Disclosure vulnerability discovered by Abdullah Kareem in WordPress Plugin WP Recipe Maker versions 10.3.0-10.8.1...

CVE-2026-87074: Missing Authorization

The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its...

CVE-2026-88929: Exposure of Sensitive Information to an Unauthorized Actor

The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin before 7.5.2 does not check whether a product is published before returning its details to unauthenticated users, allowing them to read the title, description and price of draft, pending and private products...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mutt (UTSA-2023-002883)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002883 advisory. Null pointer dereference when composing from a specially crafted draft message in Mutt 1.5.2 1.5.2 2.2.12 Tenable has extracted the preceding description block...

SUSE CVE-2026-27660

Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission...

CVE-2026-92423 Meow Gallery < 5.5.5 - Author+ Draft and Private Post Disclosure via fetch_posts

The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own posts before returning post data, allowing authenticated users with Author-level access and above to disclose the titles, authors, dates and statuses of other...

EUVD-2026-83676

The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own posts before returning post data, allowing authenticated users with Author-level access and above to disclose the titles, authors, dates and statuses of other...

WordPress Meow Gallery plugin < 5.5.5 - Author+ Draft and Private Post Disclosure vulnerability

Author+ Draft and Private Post Disclosure vulnerability discovered by Kaan Özbek in WordPress Plugin Meow Gallery versions 5.5.5...

CVE-2026-12739

The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...