CVE-2026-106002: Unknown Court Reservation: The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of…

The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of its challenge-management actions, allowing unauthenticated users to delete arbitrary tournament-ladder challenge records, along with the linked court-booking event when one was...

CVE-2026-111967: Unknown MP3 Audio Player: The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before…

The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with Contributor-level access and above to inject arbitrary JavaScript that executes when another user, such as an administrat...

PT-2026-128302

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.588 Jenkins LTS versions prior to 2.580.2 Description An issue exists where launch commands in older agent configurations are converted into launchers provided by the Command Agent Launcher Plugin without...

CVE-2026-115255: Unknown WP Roster: The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions,…

The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to delete the WordPress user accounts of roster members...

PT-2026-129219

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder component, which allows an authenticated user who can post in a channel visible to a system administrator to cause the administrator's browser to send...

Jenkins security vulnerabilities

Security vulnerabilities exist in Jenkins versions 2.587 and earlier, as well as LTS 2.580.1 and earlier. These vulnerabilities arise from the failure to verify whether an administrator has approved the startup command in the old agent configuration when converting it to a launcher provided by th...

PT-2026-127814

Name of the Vulnerable Software and Affected Versions Payconiq WordPress plugin versions prior to 1.0.5 Description An Insecure Direct Object Reference IDOR exists due to missing validation on a user-controlled key. The plugin fails to verify if a visitor is authorized to view an order before...

CVE-2026-111960: Unknown Royal MCP: The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of…

The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools, allowing authenticated users such as a subscriber to disclose the title and content of non-public entries, including personal data stored by a companion Royal M...

CVE-2026-15323: King-Theme Product Designer for WooCommerce WordPress | Lumise: The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in…

The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.2 via the processcheckout function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the serve...

Linux Distros Unpatched Vulnerability : CVE-2026-112947

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned t...

CVE-2026-111032: Unknown Welcart e-Commerce: The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted…

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted product before processing SKU changes, because its capability check is not tied to the product being edited, allowing any authenticated user with Author-level access or higher to read...

CVE-2026-76780: rankingcoach: The Beyondseo plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.3.6

The Beyondseo plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.3.6. This is due to the plugin permanently granting the 'rankingcoachwriteredirectManager' and sibling rankingcoachwrite module capabilities to the Contributor role via...

CVE-2026-115225: Unknown Customer Engagement System: The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group…

The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate the API key supplied to it, allowing unauthenticated users to make the server open connections to arbitrary internal hosts and ports and infer from response...

CVE-2026-113494: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a…

The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a listing referenced by an id attribute in its field shortcodes, allowing users with the Contributor role and above to disclose the content and custom fields of other users' draft,...

CVE-2026-93851: Mattermost: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to validate the target post ID in the…

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder component, which allows an authenticated user who can post in a channel visible to a system administrator to cause the administrator's browser to send...

PT-2026-128086

The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment notifications, as the verification is keyed on a merchant secret that is empty by default and the rest of the signed data is attacker-controlled, allowing unauthenticated attackers to...

PT-2026-127836

The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP configuration page, which is gated only on the GoSMTP WordPress plugin before 1.2.5-activation capability, allowing users with a delegated role below administrator to change outbound ma...

CVE-2026-110292: Unknown PayPlug for WooCommerce (Official): The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the…

The PayPlug for WooCommerce Official WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthenticated users to disclose another customer's order key and cancel their unpaid guest order...

CVE-2026-105997: Unknown Booking Package: The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code…

The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state, allowing unauthenticated users to make the site send templated verification-code emails to arbitrary recipients...

Linux Distros Unpatched Vulnerability : CVE-2026-117602

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's init.py module when the plugin is marked...