CVE-2026-78474

The Ni WooCommerce Sales Report WordPress plugin (versions before 4.2.0 ) is vulnerable to unauthenticated data disclosure. The root cause is a lack of authentication or authorisation checks on one of its report-printing routines, specifically involving the 'btn_print' parameter. This allows unau...

CVE-2026-78474 Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated Order and Customer Data Disclosure via 'btn_print' Parameter

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any authentication or authorisation checks on one of its report-printing routines, allowing unauthenticated users to retrieve WooCommerce order details and customer contact information, to target an individual order, and ...

CVE-2026-78472 Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated SQLi via 'sort' Parameter

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-78472

The Ni WooCommerce Sales Report WordPress plugin (versions before 4.2.0 ) is vulnerable to an unauthenticated SQL injection attack. The root cause is the failure to properly sanitize and escape a parameter—specifically the 'sort' parameter —before incorporating it into a SQL statement. This flaw ...

CVE-2026-18555

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'icn' parameter in all versions up to, and including, 2.15.22 due to insufficient input sanitization and output escaping. This makes it possib...

EUVD-2026-80113

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'icn' parameter in all versions up to, and including, 2.15.22 due to insufficient input sanitization and output escaping. This makes it possib...

CVE-2026-18555 Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress <= 2.15.22 - Reflected Cross-Site Scripting via 'icn' Parameter

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'icn' parameter in all versions up to, and including, 2.15.22 due to insufficient input sanitization and output escaping. This makes it possib...

CVE-2026-18555

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) via the icn parameter in all versions up to and including 2.15.22 . The root cause is insufficient input sanitization and output escaping. An unauth...

CVE-2026-16588

The WP Directory Kit plugin for WordPress is vulnerable to blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2026-16588 WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'order_by' Parameter

The WP Directory Kit plugin for WordPress is vulnerable to blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2026-16588

The WP Directory Kit WordPress plugin (versions up to and including 1.5.4 ) is vulnerable to blind SQL injection through the order_by parameter, caused by insufficient escaping of user-supplied input and lack of proper query preparation. An authenticated attacker with custom-level access or highe...

EUVD-2026-80095

The WP Directory Kit plugin for WordPress is vulnerable to blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2026-12793 JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content ...

CVE-2026-11984 Ad Inserter <= 2.8.16 - Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check on the ai-debug-code URL-parameter. This makes it possible for unauthenticated attackers to view...

EUVD-2026-80040

Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in routepolicyadd.cgi caused by a missing exitport parameter. Attackers can send requests lacking the exitport field to trigger the null pointer dereference, resulting in a denial of service...

EUVD-2025-210923

A Server-Side Request Forgery vulnerability exists in satproxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curlsetoptCURLOPTURL without host or scheme validation. An unauthenticated remote attacker can leverage this to make...

PT-2026-94048

Name of the Vulnerable Software and Affected Versions Harbor versions prior to 2.15.3 Description Project administrators can recover the scanner adapter secret one character at a time by exploiting fuzzy filtering on the AccessCredential column. This is possible because the software fails to...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37976)

Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability. This vulnerability stems from the lack of validation for external SQL statements in the parameter named...

PT-2026-93269

Name of the Vulnerable Software and Affected Versions WP Directory Kit versions prior to 1.5.5 Description The plugin is susceptible to blind SQL Injection, a technique that allows an attacker to infer data from a database by observing the application's response to specific queries. The issue...

PT-2026-93272

Name of the Vulnerable Software and Affected Versions Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots versions prior to 2.15.23 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting XSS, ...