PT-2026-95801

Name of the Vulnerable Software and Affected Versions TikTok plugin for WordPress versions prior to 1.4.2 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to overwrite...

PT-2026-95765

Name of the Vulnerable Software and Affected Versions MgoSync WordPress plugin versions prior to 2.1.7 Description The plugin lacks authorization controls on a REST API endpoint, which enables unauthenticated users to retrieve stored WooCommerce API credentials. This includes the read/write...

PT-2026-95754

Name of the Vulnerable Software and Affected Versions Estatik Real Estate Plugin WordPress plugin versions prior to 4.3.5 Description Reflected Cross-Site Scripting occurs because the plugin fails to sanitize and escape several values decoded from a request parameter before reflecting them in an...

CVE-2026-5400: Improper Neutralization of Input During Web Page Generation

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media field filter values in versions up to, and including, 4.5.13 This is due to insufficient input sanitization of nested array values in the usermetasave function and unsafe output of filter CSS value...

CVE-2026-93873

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to forge messages. Attackers can auto-submit contact forms from attacker-controlled pages to send forged messages attributed to authenticated victims to the administrator inbox...

CVE-2026-93869

Cotonti through 1.0.0 contains an open redirect vulnerability in the coturlcheck function that validates redirect destinations using a regular expression lacking an end-of-string anchor. Attackers can bypass the redirect guard by supplying hostnames beginning with the site domain to redirect user...

CVE-2026-93873 Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to forge messages. Attackers can auto-submit contact forms from attacker-controlled pages to send forged messages attributed to authenticated victims to the administrator inbox...

CVE-2026-93873 Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to forge messages. Attackers can auto-submit contact forms from attacker-controlled pages to send forged messages attributed to authenticated victims to the administrator inbox...

CVE-2026-93873 Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to forge messages. Attackers can auto-submit contact forms from attacker-controlled pages to send forged messages attributed to authenticated victims to the administrator inbox...

CVE-2026-93873

Cotonti CMS through version 1.0.0 is affected by a Cross-Site Request Forgery (CSRF) vulnerability in the contact plugin's submission handler (plugins/contact/contact.php). The root cause is a failure to validate anti-CSRF tokens, allowing attackers to auto-submit contact forms from attacker-cont...

EUVD-2026-83370

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to forge messages. Attackers can auto-submit contact forms from attacker-controlled pages to send forged messages attributed to authenticated victims to the administrator inbox...

CVE-2026-93872 Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter

Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize without allowedclasses restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file write or code execution through gadget chain...

CVE-2026-93872 Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter

Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize without allowedclasses restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file write or code execution through gadget chain...

CVE-2026-93870 Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated users. Attackers can craft malicious pages that auto-submit POST requests to modify stored rating data when visited by logged-in users...

CVE-2026-93870 Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated users. Attackers can craft malicious pages that auto-submit POST requests to modify stored rating data when visited by logged-in users...

CVE-2026-93870 Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated users. Attackers can craft malicious pages that auto-submit POST requests to modify stored rating data when visited by logged-in users...

CVE-2026-93870

Cotonti through 1.0.0 has a Cross-Site Request Forgery (CSRF) vulnerability in the ratings plugin AJAX handler (ratings.ajax.php). The root cause is a failure to validate anti-CSRF tokens, allowing an attacker to craft a malicious page that auto-submits POST requests to modify stored rating data ...

CVE-2026-93869 Cotonti through 1.0.0 Open Redirect via Unanchored cot_url_check() Regex

Cotonti through 1.0.0 contains an open redirect vulnerability in the coturlcheck function that validates redirect destinations using a regular expression lacking an end-of-string anchor. Attackers can bypass the redirect guard by supplying hostnames beginning with the site domain to redirect user...

WordPress TikTok plugin <= 1.4.1 - Missing Authorization to Unauthenticated TikTok Integration Takeover vulnerability

Missing Authorization to Unauthenticated TikTok Integration Takeover vulnerability discovered by Hillary Mutai in WordPress Plugin TikTok versions = 1.4.1...

CVE-2019-25776

Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by submitting malicious input through the userIdentifiers GET parameter in the mobile plugin endpoint. Attackers can bypass space-based filter controls by wrapping...