CVE-2026-9766: Missing Authorization

The Empik for Woocommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

PT-2026-95804

Name of the Vulnerable Software and Affected Versions Gum Addon for Elementor versions prior to 1.3.16 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary we...

CVE-2026-11899: Missing Authorization

The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible...

PT-2026-95736

Name of the Vulnerable Software and Affected Versions SEO Booster versions prior to 7.4.8 Description The SEO Booster plugin for WordPress contains a missing authorization flaw. The handle oauth callback function, which is hooked to admin init, fails to perform a capability check when processing...

CVE-2026-15098: Improper Neutralization of Input During Web Page Generation

The Real3D Flipbook Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lightboxtext' shortcode attribute and other unsanitized attributes handled by onshortcode in versions up to, and including, 5.1.1. This is due to insufficient input sanitization and output escaping...

PT-2026-95808

Name of the Vulnerable Software and Affected Versions Empik for Woocommerce versions prior to 1.5.2 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or...

PT-2026-95795

Name of the Vulnerable Software and Affected Versions Easy Appointments versions prior to 3.12.28 Description The plugin is subject to sensitive information exposure through the handle customers ajax function. Authenticated attackers with contributor-level access or higher can extract the complet...

CVE-2026-89333: Authorization Bypass Through User-Controlled Key

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 via the 'studentid' parameter due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2026-87909: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppaimagemagick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec, with only...

PT-2026-95809

Name of the Vulnerable Software and Affected Versions Partial Shipment for Woocommerce versions prior to 3.5 Description Missing authorization in the plugin allows authenticated users with Subscriber-level access and above to access and modify order data. The issue exists within the...

PT-2026-95777

Name of the Vulnerable Software and Affected Versions AppMySite – WordPress & WooCommerce Mobile App Builder versions prior to 3.15.4 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Subscriber-level access and...

PT-2026-95789

Name of the Vulnerable Software and Affected Versions Redux Framework versions prior to 4.5.14 Description Stored Cross-Site Scripting occurs via Media field filter values. The issue stems from insufficient input sanitization of nested array values in the user meta save function and unsafe output...

PT-2026-95734

Name of the Vulnerable Software and Affected Versions WP2Social Auto Publish versions prior to 2.4.13 Description Insufficient input sanitization and output escaping in the admin settings allow authenticated attackers with administrator-level permissions or higher to perform Stored Cross-Site...

PT-2026-95772

Name of the Vulnerable Software and Affected Versions PDF Builder for WooCommerce. Create invoices,packing slips and more versions prior to 2.0.12 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions...

CVE-2026-9855: Improper Neutralization of Special Elements used in an SQL Command

The Custom Field Template plugin for WordPress is vulnerable to generic SQL Injection via the 'postID' parameter in all versions up to, and including, 2.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-15760: Missing Authorization

The Divi Essential plugin for WordPress is vulnerable to sensitive information exposure in versions up to, and including, 5.8.1 via the dnxtegetdatabasetables and dnxtegetdatabasedata AJAX actions. The handlers only conditionally verify a nonce the check runs solely when the 'nonce' POST paramete...

CVE-2026-8354: Improper Neutralization of Input During Web Page Generation

The Gum Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'poptag' parameter in all versions up to, and including, 1.3.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-1984: Missing Authorization

The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepausegteditor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with...

CVE-2026-9613: Missing Authorization

The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

CVE-2026-6295: Improper Neutralization of Special Elements used in an SQL Command

The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe subquery-detection branch in the Query::parsekeycomparefield method that, when the user-supplied value matches the regex ^\sSELECT\s+, wra...