CVE-2026-82841: Exposure of Sensitive Information to an Unauthorized Actor

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have any capability check in a routine that outputs its stored remote storage settings into admin pages when the site is left in a...

CVE-2026-96899: Improper Neutralization of Input During Web Page Generation

The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site...

CVE-2026-84069: Improper Limitation of a Pathname to a Restricted Directory

The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it to include a local file, allowing unauthenticated users to perform Local File Inclusion...

PT-2026-99492

Name of the Vulnerable Software and Affected Versions WebFacing™ WordPress plugin versions prior to 5.4 Description An issue exists where the software fails to restrict access to a bundled script and does not validate a user-supplied path before including a local file. This allows unauthenticated...

PT-2026-99490

Name of the Vulnerable Software and Affected Versions Ad Inserter WordPress plugin versions prior to 2.8.19 Description Insufficient access restrictions on a settings page allow any logged-in user, including those with the subscriber role, to access the page under certain configurations. The plug...

PT-2026-99491

Name of the Vulnerable Software and Affected Versions UpdraftPlus: WP Backup & Migration Plugin versions prior to 1.26.8 UpdraftPlus: WP Backup & Migration Plugin versions prior to 2.26.8.26 Description A missing capability check in a routine that outputs stored remote storage settings into admin...

PT-2026-99505

Name of the Vulnerable Software and Affected Versions Optima Express IDX WordPress plugin versions prior to 8.7.6 Description An authorization check is missing in an AJAX action available to logged-out users. This allows unauthenticated attackers to force the creation of an account with a fixed...

PT-2026-99494

Name of the Vulnerable Software and Affected Versions Download Manager WordPress plugin Pro edition versions prior to 7.5.6 Description The Pro edition of the plugin fails to sanitize and escape data submitted via the email-locked download subscription form before displaying it on an administrati...

PT-2026-99569

Name of the Vulnerable Software and Affected Versions utcp-mcp versions prior to 1.1.3 Description The MCP plugin of python-utcp fails to apply ensure secure url validation when connecting to HTTP and WebSocket MCP server URLs defined in a call template's mcpServers configuration. This omission...

CVE-2024-25600-EXPLOIT

CVE-2024-25600 - WordPress Bricks Builder 远程代码执行 RCE 🌐 WordPress 的 Bricks 主题被确认存在一个关键安全漏洞，编号为 CVE-2024-25600。该漏洞影响 Bricks Builder 插件的所有版本（包括 1.9.6）。此漏洞构成重大风险，因为它允许未经身份验证的攻击者在托管存在漏洞的 WordPress 网站的服务器上远程执行任意代码。CVE-2024-25600 属于远程代码执行 RCE 漏洞，使攻击者能够在无需任何身份验证的情况下操纵服务器执行恶意代码。该漏洞利用了 Bricks Builder...

CVE-2026-97160

Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29...

CVE-2026-97161

Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29...

CVE-2026-97162

Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29...

CVE-2026-97163

Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29...

CVE-2021-34621-EXPLOIT

CVE-2021-34621 - Escalada de Privilegios en WordPress Se ha identificado una vulnerabilidad crítica en el componente de registro de usuarios del plugin ProfilePress para WordPress. Esta falla de seguridad, asignada con el CVE-2021-34621, permite a usuarios no autorizados registrarse en sitios web...

CVE-2026-97161

The UP (Universal Plugin) for Joomla (specifically the plg_content_up component) is vulnerable to unauthenticated path traversal and arbitrary file read (CWE-22, CWE-284). The root cause lies in AJAX file-access handlers, particularly the ajax-view popup loader, which allows attackers to read sen...

EUVD-2026-87781

Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29...

CVE-2026-97161 Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29...

CVE-2026-97161 Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29...

CVE-2026-97163 Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29...