CVE-2026-12739: Missing Authorization

The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

PT-2026-95351

Name of the Vulnerable Software and Affected Versions NetBackup Flex OS affected versions not specified Description An authenticated, low-privileged user with access to the management shell can provide specially crafted input to a privileged administrative command. This leads to arbitrary code...

CVE-2026-12954: Improper Input Validation

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the myprofileupdate function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplie...

CVE-2026-93764: Cleartext Storage of Sensitive Information

Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feature can therefore store values intended to be encrypted in readable form, with no error or warning. A party with routine read...

PT-2026-95563

Name of the Vulnerable Software and Affected Versions Mongoid affected versions not specified Description Mongoid may omit encryption rules for fields declared on embedded models during the generation of the client-side field-level encryption schema. This allows applications using this feature to...

CVE-2026-89413: Missing Authorization

The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

PT-2026-95222

Name of the Vulnerable Software and Affected Versions RT Mega Menu versions prior to 1.5.2 Description Insufficient input sanitization and output escaping allow authenticated attackers with Subscriber-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting...

CVE-2026-93031: Unrestricted Upload of File with Dangerous Type

The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the downloadfiletouploads function. This is due to the import action being registered for...

CVE-2026-15004: Improper Neutralization of Input During Web Page Generation

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 6.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

PT-2026-95268

Name of the Vulnerable Software and Affected Versions Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress versions prior to 2.5.4 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform...

CVE-2026-18317: Missing Authorization

The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

PT-2026-95234

Name of the Vulnerable Software and Affected Versions King Addons for Elementor versions prior to 51.1.81 Description An issue exists where the software fails to perform an object-level authorization check during the import of template content into a page. This allows users with contributor-level...

PT-2026-95290

Name of the Vulnerable Software and Affected Versions WP Inventory Manager versions prior to 2.5.2 Description Authenticated attackers with Contributor-level access and above can perform SQL Injection through the where shortcode attribute of the wpinventory shortcode. The issue occurs in the...

CVE-2026-12106: Server-Side Request Forgery (SSRF)

The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the downloadImage function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitra...

CVE-2026-84071: Improper Neutralization of Special Elements used in an OS Command

IBM Guardium Data Protection 12.2 is vulnerable to OS command injection in the Universal Connector plugin upload functionality. A privileged authenticated attacker can provide a malicious filename that is incorporated into a shell command executed by the application, potentially resulting in...

CVE-2026-88994: Improper Control of Filename for Include/Require Statement in PHP Program

The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PH...

CVE-2026-84902: Improper Neutralization of Input During Web Page Generation

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users with contributor-level access and above to overwrite the Elementor content of arbitrary posts and pages, including those...

CVE-2025-13533: Improper Neutralization of Input During Web Page Generation

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 12.0.6 via the Assignment Engine fields. This is due to insufficient input sanitization and output escaping on assignment data fields including Expressions, URLs, a...

PT-2026-95281

Name of the Vulnerable Software and Affected Versions WP Easy Pay – Payment and Donation form Builder for Square versions prior to 4.5.1 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated...

PT-2026-95344

Name of the Vulnerable Software and Affected Versions WP Recipe Maker versions prior to 10.8.2 Description Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injectin...