CVE-2026-81339: Authorization Bypass Through User-Controlled Key

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform a per-object ownership check when returning a quiz attempt result, allowing any authenticated user with a minimal subscriber role to read other students' quiz grades, pass/fail status and attempt timestamps by...

CVE-2026-91024: Improper Neutralization of Special Elements used in an SQL Command

The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control...

PT-2026-97479

Subscriber Arbitrary File Deletion in WP User Frontend = 4.3.11 versions...

CVE-2026-84098: Incorrect Authorization

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary listings, including ones belonging...

CVE-2026-18364: Missing Authorization

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings...

PT-2026-97166

Name of the Vulnerable Software and Affected Versions WP OAuth Server Login with WordPress versions prior to 6.4.0 Description The plugin fails to bind the OpenID Connect identity assertion to the authorization grant being exchanged. Instead, it returns the assertion of the most recently...

CVE-2026-91077: Improper Access Control

The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event...

PT-2026-97183

Name of the Vulnerable Software and Affected Versions Real3D Flipbook versions prior to 5.4 Description Insufficient capability checks on authenticated flipbook management actions allow users with Author-level access and above to delete flipbook content belonging to other users and overwrite glob...

PT-2026-97169

Name of the Vulnerable Software and Affected Versions The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions prior to 8.9.5 Description The plugin fails to verify user capabilities when processing order creation via its REST API. This allows users with...

PT-2026-97177

Name of the Vulnerable Software and Affected Versions HappyAddons for Elementor versions prior to 3.50.0 Description An issue exists where an icon value in a button widget is not properly escaped before being output within an HTML attribute. This allows users with Contributor-level access or high...

PT-2026-97172

Name of the Vulnerable Software and Affected Versions The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions prior to 8.9.5 Description An issue exists where the plugin fails to verify if the target user of a REST route matches the authenticated caller...

PT-2026-97194

The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or...

PT-2026-97202

Name of the Vulnerable Software and Affected Versions Getwid – Gutenberg Blocks versions prior to 2.1.4 Description Stored Cross-Site Scripting occurs via the 'customStyle' attribute of the Google Maps block. The issue stems from the use of the eval function on user-controlled block content withi...

CVE-2026-95530: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in PixelYourSite – Your smart PIXEL TAG Manager = 11.4.1 versions...

CVE-2026-95525: Improper Limitation of a Pathname to a Restricted Directory

Subscriber Arbitrary File Deletion in WP User Frontend = 4.3.11 versions...

CVE-2026-18872: Improper Neutralization of Input During Web Page Generation

IBM Financial Transaction Manager FTM for RedHat OpenShift is vulnerable to stored cross-site scripting CWE-79 in the FTM UI NetworkAcknowledgement React component NetworkAcknowledgement.jsx:42. A malicious actor can inject script into stored network acknowledgement data that executes in...

CVE-2026-6831: Missing Authorization

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-93507: Missing Authorization

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read...

CVE-2026-93508: Missing Authorization

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless ...

CVE-2026-91025: Authorization Bypass Through User-Controlled Key

The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or...