PT-2026-99777

Name of the Vulnerable Software and Affected Versions Post Voting System WordPress plugin version 1.0 Description An issue exists where the software fails to properly sanitize and escape a parameter before incorporating it into a SQL query. This allows authenticated users to execute SQL injection...

CVE-2026-89303: Improper Neutralization of Special Elements used in an SQL Command

The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks...

CVE-2026-93000: Improper Neutralization of Special Elements used in an SQL Command

The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-84744: Improper Control of Generation of Code

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments...

PT-2026-99778

Name of the Vulnerable Software and Affected Versions Paymattic WordPress plugin versions 4.6.20 through 4.6.25 Description The plugin fails to verify if a confirmed Stripe payment is associated with the specific order it is being applied to. This allows unauthenticated users to mark any pending...

CVE-2026-89300: Missing Authorization

The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data into its own database table, as well as to make the site send templated verification emails to arbitrary email addresses. The...

CVE-2026-92996: Insufficient Verification of Data Authenticity

The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order ownership, allowing unauthenticated users to mark any order as paid...

CVE-2026-77770

CVE-2026-77770 miniOrange 2FA CVE POC miniOrange 2FA（WordPress 插件 miniorange-2-factor-authentication）≤ 6.3.0 — 通过电子邮件验证链接（userID / Txid / accessToken）实现未认证的任意 WordPress 选项删除。 仅限授权测试。请勿对您不拥有或未获授权测试的系统运行此工具。 要求： Python 3，仅使用标准库。 python3 cve-2026-77770-miniorange-2fa-option-delete.py -u http://TARGE...

CVE-2026-100868

Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return...

CVE-2026-100868

Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return...

CVE-2026-100868 Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge

Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return...

EUVD-2026-87940

Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return...

CVE-2026-100868

Versions of Penpot prior to 2.18.0 are vulnerable to unauthenticated access via the MCP server plugin WebSocket bridge . In single-user mode, the bridge binds to all network interfaces without authentication, allowing unauthenticated attackers on adjacent networks to connect to the WebSocket port...

CVE-2026-0920

CVE-2026-0920 - WordPress Plugin LA-Studio Element Kit / Unauthenticated Privilege Escalation A proof-of-concept exploit for CVE-2026-0920 , an unauthenticated privilege-escalation vulnerability in the LA-Studio Element Kit WordPress plugin. The vulnerability allows an unauthenticated attacker to...

CVE-2026-96899

The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site...

CVE-2026-89003

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the response, allowing users with contributor-level access and above to force the server to issue requests to internal-only hosts and read the...

CVE-2026-86841

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users granted a custom booking-management capability, which an...

CVE-2026-86609

The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against...

CVE-2026-85002

The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher privileged users viewing the post...

CVE-2026-84069

The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it to include a local file, allowing unauthenticated users to perform Local File Inclusion...