CVE-2026-108695 MultiVendorX through 5.0.19 Incorrect Authorization via Settings REST Endpoint

MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the storeowner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only...

PT-2026-110051

Name of the Vulnerable Software and Affected Versions KeyWord Collector versions prior to 1.5 Description Lack of authorization and nonce checks when saving settings allows unauthenticated attackers to perform a stored Cross-Site Scripting XSS attack. This occurs because the plugin fails to escap...

PT-2026-110010

Name of the Vulnerable Software and Affected Versions Mobile builder WordPress plugin versions prior to 1.4.3 Description Unauthenticated users can perform SQL injection attacks because the plugin fails to sanitize and escape a parameter before incorporating it into a SQL statement. SQL injection...

PT-2026-110037

Name of the Vulnerable Software and Affected Versions AI Content Generator Marketing WordPress plugin version 1.0.0 Description Certain AJAX actions fail to enforce a nonce a unique token used to prevent cross-site request forgery or capability checks. This allows unauthenticated users to update ...

CVE-2026-86717: Missing Authorization

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role...

PT-2026-110070

Name of the Vulnerable Software and Affected Versions WP-Invoice versions prior to 4.3.2 Description Several AJAX handlers in the plugin fail to perform capability checks. This allows any authenticated user, including those with Subscriber level permissions, to retrieve personally identifiable...

PT-2026-110054

Name of the Vulnerable Software and Affected Versions Llavero.io versions prior to 0.1.5 Description An issue exists where the software fails to properly sanitize and escape the cill login parameter before incorporating it into a SQL statement. This allows unauthenticated attackers to execute SQL...

CVE-2026-103305: Improper Neutralization of Input During Web Page Generation

The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors...

CVE-2026-85121: Missing Authorization

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to create and overwrite arbitrary WordPress options with request data, which can take the site offline and deactivate all of its Insurify WordPress...

CVE-2026-89283: Missing Authorization

The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite the password of every published post, disclosing...

CVE-2026-89195: Improper Neutralization of Special Elements used in an SQL Command

The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

PT-2026-110016

Name of the Vulnerable Software and Affected Versions WeddingCity Lite WordPress plugin versions prior to 1.0.5 Description The plugin fails to perform authorization or validity checks before deleting posts, pages, and media attachments. This allows unauthenticated attackers to permanently delete...

PT-2026-110029

Name of the Vulnerable Software and Affected Versions click5 CRM add-on to Gravity Forms versions prior to 1.0.4 Description The plugin lacks authorization and Cross-Site Request Forgery CSRF checks when updating options through a REST endpoint. Additionally, it fails to verify if the option bein...

PT-2026-110159

Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips the authToken check on POST /pinclaw/send. Unauthenticated attackers reaching port 18790, which binds all interfaces by default, can inject blind prompts int...

PT-2026-110061

Name of the Vulnerable Software and Affected Versions Loja Automática versions prior to 1.0.1 Description Unauthenticated users can perform SQL injection attacks because the plugin fails to properly sanitize and escape the id parameter before incorporating it into a SQL query. SQL injection is a...

CVE-2026-108757: Missing Authentication for Critical Function

Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips the authToken check on POST /pinclaw/send. Unauthenticated attackers reaching port 18790, which binds all interfaces by default, can inject blind prompts int...

CVE-2026-84734: Improper Authentication

The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress...

CVE-2026-89232: Improper Neutralization of Special Elements used in an SQL Command

The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database...

CVE-2026-89297: Improper Neutralization of Special Elements used in an SQL Command

The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

PT-2026-110128

Name of the Vulnerable Software and Affected Versions Cheshire Cat AI core versions prior to 2.0.24 Description A stored cross-site scripting issue exists in the uploads plugin. Authenticated users can upload HTML files via the 'POST /uploads' endpoint because there are no file type restrictions...