CVE-2026-78088

The Contest Gallery WordPress plugin (Upload & Vote Photos, Media, Sell with PayPal & Stripe) versions up to and including 32.0.1 are affected by an Unauthenticated Arbitrary File Overwrite vulnerability caused by insufficient file path validation in the 'baseUrlForFacebook' parameter . Attackers...

EUVD-2026-80098

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it...

CVE-2026-18595 WP-Lister Lite for eBay <= 3.8.9 - Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request

The WP-Lister Lite for eBay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via AJAX Cron Handler Request Parameter in all versions up to, and including, 3.8.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-18595

WP-Lister Lite for eBay (WordPress plugin) is vulnerable to Stored Cross-Site Scripting via the AJAX Cron Handler Request Parameter in all versions up to and including 3.8.9 , caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts...

CVE-2026-16588 WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'order_by' Parameter

The WP Directory Kit plugin for WordPress is vulnerable to blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2026-11984 Ad Inserter <= 2.8.16 - Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check on the ai-debug-code URL-parameter. This makes it possible for unauthenticated attackers to view...

CVE-2026-16588

The WP Directory Kit WordPress plugin (versions up to and including 1.5.4 ) is vulnerable to blind SQL injection through the order_by parameter, caused by insufficient escaping of user-supplied input and lack of proper query preparation. An authenticated attacker with custom-level access or highe...

CVE-2026-11984

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is affected by an authorization bypass in all versions up to and including 2.8.16 . The root cause is a missing capability check on the ai-debug-code URL-parameter, which allows unauthenticated attackers to view administrator-configu...

EUVD-2026-80095

The WP Directory Kit plugin for WordPress is vulnerable to blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2026-12793

JetFormBuilder — Dynamic Blocks Form Builder for WordPress (by Crocoblock/jetmonsters) is vulnerable to unauthenticated privilege escalation in all versions up to and including 3.6.2 . The root cause is that the plugin does not validate that the _jet_engine_booking_form_id parameter refers to a p...

CVE-2026-12793 JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content ...

EUVD-2026-80096

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check on the ai-debug-code URL-parameter. This makes it possible for unauthenticated attackers to view...

EUVD-2026-80094

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-14349

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.2.3 . The root cause is a missing permission check on the admin_addcustomer AJAX action in main/function_ajax.php, allowing unauthenticated at...

CLEANSTART-2026-GW77529 Previously, resolving relative paths containing parent directory ('

Multiple security vulnerabilities affect the velero-plugin-for-csi package. Previously, resolving relative paths containing parent directory '. See references for individual vulnerability details...

CLEANSTART-2026-WA59044 gRPC-Go is the Go language implementation of gRPC

Multiple security vulnerabilities affect the velero-plugin-for-csi package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

PT-2026-93301

The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only...

PT-2026-93313

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI...

PT-2026-93282

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission ...

PT-2026-93276

The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing users granted its export permission to write files with arbitrary names to arbitrary locations on the server, leading to remote code execution...