CVE-2026-111960: Unknown Royal MCP: The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of…

The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools, allowing authenticated users such as a subscriber to disclose the title and content of non-public entries, including personal data stored by a companion Royal M...

Linux Distros Unpatched Vulnerability : CVE-2026-112947

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned t...

CVE-2026-110292: Unknown PayPlug for WooCommerce (Official): The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the…

The PayPlug for WooCommerce Official WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthenticated users to disclose another customer's order key and cancel their unpaid guest order...

WordPress Clean Login authorization issue vulnerability

WordPress Clean Login versions 1.20.1 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of permission checks in the CleanLoginShortcode::getpageswithshortcodes function, which is hooked into the savepost action. As a result, authenticated attackers wit...

CVE-2026-115225: Unknown Customer Engagement System: The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group…

The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate the API key supplied to it, allowing unauthenticated users to make the server open connections to arbitrary internal hosts and ports and infer from response...

CVE-2026-93851: Mattermost: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to validate the target post ID in the…

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder component, which allows an authenticated user who can post in a channel visible to a system administrator to cause the administrator's browser to send...

Mattermost path traversal vulnerability

Mattermost versions 11.9.1 and earlier within the 11.9.x series, 11.8.5 and earlier within the 11.8.x series, and 11.7.10 and earlier within the 11.7.x series contain a path traversal vulnerability. This vulnerability arises because the Agents plugin references the Reminder component without...

CVE-2026-105997: Unknown Booking Package: The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code…

The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state, allowing unauthenticated users to make the site send templated verification-code emails to arbitrary recipients...

Linux Distros Unpatched Vulnerability : CVE-2026-117602

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's init.py module when the plugin is marked...

CVE-2026-111032: Unknown Welcart e-Commerce: The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted…

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted product before processing SKU changes, because its capability check is not tied to the product being edited, allowing any authenticated user with Author-level access or higher to read...

CVE-2026-76780: rankingcoach: The Beyondseo plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.3.6

The Beyondseo plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.3.6. This is due to the plugin permanently granting the 'rankingcoachwriteredirectManager' and sibling rankingcoachwrite module capabilities to the Contributor role via...

CVE-2026-113494: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a…

The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a listing referenced by an id attribute in its field shortcodes, allowing users with the Contributor role and above to disclose the content and custom fields of other users' draft,...

PT-2026-127836

The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP configuration page, which is gated only on the GoSMTP WordPress plugin before 1.2.5-activation capability, allowing users with a delegated role below administrator to change outbound ma...

PT-2026-128086

The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment notifications, as the verification is keyed on a merchant secret that is empty by default and the rest of the signed data is attacker-controlled, allowing unauthenticated attackers to...

Linux Distros Unpatched Vulnerability : CVE-2026-116675

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object...

CVE-2026-103372: Unknown Payconiq: The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is allowed to see an order before returning…

The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is allowed to see an order before returning its confirmation link, allowing unauthenticated users to obtain any paid order's key and, for recent guest orders, view the customer's personal details...

PT-2026-128261

Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF Abstracts List falls through to a...

CVE-2026-103370: awesomesupport Awesome Support – WordPress HelpDesk & Support Plugin: The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site…

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpasfiles' parameter in all versions up to, and including, 6.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

CVE-2026-104694: Unknown Thrive Automator: The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter's array key before…

The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter's array key before using it in a SQL query, allowing authenticated attackers with editor-level access to perform blind SQL injection attacks...

PT-2026-127847

The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate the API key supplied to it, allowing unauthenticated users to make the server open connections to arbitrary internal hosts and ports and infer from response...