CVE-2026-112347: Themeum Kirki: Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST…

Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/pageid route and the savepagedata, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middleware...

CVE-2026-114444: Unknown: The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its…

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress...

CVE-2026-111487: qt Qt Framework: An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module.

An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module...

PT-2026-133570

Name of the Vulnerable Software and Affected Versions Qt Framework versions prior to 6.12.0-2.1 Description An out-of-bounds write issue exists in the assimp scene import plugin of the Qt3D module. An out-of-bounds write occurs when a program writes data past the end of the intended buffer, which...

PT-2026-134445

Name of the Vulnerable Software and Affected Versions Webmention plugin for WordPress versions prior to 5.10.2 Description Stored Cross-Site Scripting occurs via the Open Graph og:title meta tag of a webmention source URL. The issue stems from insufficient input sanitization where Meta::add...

PT-2026-133281

The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts function in versions up to, and including, 12.0.0. The handler verifies a static nonce 'contentegg metabox' and the generic 'edit posts'...

PT-2026-133793

Name of the Vulnerable Software and Affected Versions LeadSnap versions 1.25 and earlier Description An unauthenticated attacker can perform a PHP Object Injection by sending crafted input to the lead plugin. This occurs when the application unserializes untrusted data, which can lead to the...

CVE-2026-89435: strategy11team: The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is…

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'fileurl' parameter parameter. This is due to insufficient URL prefix validation in...

CVE-2026-119714: joedolson My Calendar - Accessible Event Manager: My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows…

My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mcsearchresults in src/my-calendar-search.php without bracket encoding before...

CVE-2026-104066: Scribus: Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the Mac PICT image loader…

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out...

PT-2026-133299

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'file url' parameter parameter. This is due to insufficient URL prefix validation in...

Scribus buffer error vulnerability

Versions of Scribus prior to 1.6.7 contain a buffer error vulnerability. This vulnerability arises because the PICT image loader and import plugin fail to validate the bytesPerLine value, leading to a heap buffer overflow. Attackers can exploit this by providing a specially crafted PICT file that...

CVE-2026-118698: beardev: The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL…

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'pgroup' parameter in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

PT-2026-133618

Name of the Vulnerable Software and Affected Versions Scribus versions prior to 1.6.7 Scribus versions 1.7.x prior to 1.7.4 Description An out-of-bounds read exists in the Mac PICT image loader and import plugin during the decoding of planar pixel data. A remote attacker can provide a specially...

PT-2026-133689

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.5.15 via the multi media field. This is due to the field's renderer printing the stored value into an href attribute, a hidden input value and an HTML element without...

CVE-2026-119113: paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to…

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the listing description postcontent in versions up to, and including, 2.8.199 This is due to insufficient input sanitization on save the bundled...

CVE-2026-114443: Unknown: The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the…

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an...

CVE-2026-104065: Scribus: Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds write vulnerability in the importdrw Micrografx…

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap...

CVE-2026-104063: Scribus: Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds read vulnerability in the Mac PICT image loader…

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or imported, causes heap over-reads leadi...

CVE-2022-0236

CVE-2022-0236 The WP Import Export WordPress plugin is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpieprocessfiledownload found in the /includes/classes/class-wpie-general.php file. This made it possible for unauthenticated...