CVE-2026-93747: Improper Neutralization of Input During Web Page Generation

The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'telegram' profile field in versions up to, and including, 3.1.6. This is due to insufficient input sanitization and output escaping in the profileupdate action — the raw $POST'data' array is copied into a...

CVE-2026-13456: Improper Control of Filename for Include/Require Statement in PHP Program

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authenticated attackers, with...

PT-2026-98371

Name of the Vulnerable Software and Affected Versions Blog2Social: Social Media Auto Post & Scheduler versions prior to 9.1.1 Description An authorization bypass exists because the software fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with...

CVE-2026-92829: Missing Authorization

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

PT-2026-98533

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the iova to phys function when using a 5-level translation table via ZPCI TABLE TYPE RFX. This happens because the get rto from iova function fails t...

PT-2026-98394

Name of the Vulnerable Software and Affected Versions User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor versions prior to 4.0.3 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and...

CVE-2026-93656: Improper Neutralization of Input During Web Page Generation

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it...

PT-2026-98458

Name of the Vulnerable Software and Affected Versions Akia keyless entry cloud service affected versions not specified Description An Insecure Direct Object Reference IDOR exists due to missing object-level authorization. The unlock action relies on a client-supplied room or door identifier that...

CVE-2025-14814: Improper Neutralization of Input During Web Page Generation

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbox shortcode in all versions up to, and including, 12.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2026-89426: Improper Privilege Management

The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the maybeupdateuserrole function reading the target role directly from an attacker-controlled Gravity Forms entry...

CVE-2026-17602: Improper Limitation of a Pathname to a Restricted Directory

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.7.42 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, t...

CVE-2026-12037: Server-Side Request Forgery (SSRF)

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.0.5 via the 'pageurl' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to...

CVE-2026-96766: Improper Neutralization of Input During Web Page Generation

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businesshours' parameter in all versions up to, and including, 2.8.183 due to insufficient input sanitization and output escaping. This make...

CVE-2026-93899: Improper Neutralization of Special Elements used in an SQL Command

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'groupid' Message Meta Parameter in all versions up to, and including, 3.0.4 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-93897: Improper Neutralization of Input During Web Page Generation

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text-type Custom Field e.g., 'phone' in all versions up to, and including, 2.8.181 due to insufficient input sanitization and output escaping. Th...

PT-2026-98375

Name of the Vulnerable Software and Affected Versions GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress versions prior to 2.8.182 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level...

PT-2026-98379

Name of the Vulnerable Software and Affected Versions GeoDirectory versions prior to 2.8.184 Description The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input...

CVE-2026-92746: Improper Neutralization of Input During Web Page Generation

The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Comment Block 'suffixMain' Attribute in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it...

PT-2026-98381

Name of the Vulnerable Software and Affected Versions WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters versions prior to 4.9.9 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above t...

CVE-2026-13179: Improper Neutralization of Input During Web Page Generation

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shapesvalues Parameter in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes ...