PT-2026-128086

The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment notifications, as the verification is keyed on a merchant secret that is empty by default and the rest of the signed data is attacker-controlled, allowing unauthenticated attackers to...

PT-2026-127836

The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP configuration page, which is gated only on the GoSMTP WordPress plugin before 1.2.5-activation capability, allowing users with a delegated role below administrator to change outbound ma...

CVE-2026-110292: Unknown PayPlug for WooCommerce (Official): The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the…

The PayPlug for WooCommerce Official WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthenticated users to disclose another customer's order key and cancel their unpaid guest order...

CVE-2026-105997: Unknown Booking Package: The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code…

The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state, allowing unauthenticated users to make the site send templated verification-code emails to arbitrary recipients...

Linux Distros Unpatched Vulnerability : CVE-2026-117602

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's init.py module when the plugin is marked...

Mattermost path traversal vulnerability

Mattermost versions 11.9.1 and earlier within the 11.9.x series, 11.8.5 and earlier within the 11.8.x series, and 11.7.10 and earlier within the 11.7.x series contain a path traversal vulnerability. This vulnerability arises because the Agents plugin references the Reminder component without...

Linux Distros Unpatched Vulnerability : CVE-2026-116675

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object...

CVE-2026-103372: Unknown Payconiq: The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is allowed to see an order before returning…

The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is allowed to see an order before returning its confirmation link, allowing unauthenticated users to obtain any paid order's key and, for recent guest orders, view the customer's personal details...

WordPress Clean Login authorization issue vulnerability

WordPress Clean Login versions 1.20.1 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of permission checks in the CleanLoginShortcode::getpageswithshortcodes function, which is hooked into the savepost action. As a result, authenticated attackers wit...

PT-2026-132243

Name of the Vulnerable Software and Affected Versions Extra Fees Plugin for WooCommerce versions prior to 4.4.1 Description The plugin is susceptible to PHP Object Injection, a condition where an application deserializes untrusted input, potentially allowing an attacker to manipulate the...

PT-2026-127838

The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requested page, relying on a generic capability, which allows users with contributor-level access to read the full content of any private or draft page and to publish it without...

PT-2026-128261

Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF Abstracts List falls through to a...

Linux Distros Unpatched Vulnerability : CVE-2026-117603

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed dailylimitsa...

PT-2026-127847

The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate the API key supplied to it, allowing unauthenticated users to make the server open connections to arbitrary internal hosts and ports and infer from response...

CVE-2026-113487: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link…

The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link value before outputting it in an anchor element on a listing, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against...

CVE-2026-104694: Unknown Thrive Automator: The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter's array key before…

The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter's array key before using it in a SQL query, allowing authenticated attackers with editor-level access to perform blind SQL injection attacks...

CVE-2026-103370: awesomesupport Awesome Support – WordPress HelpDesk & Support Plugin: The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site…

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpasfiles' parameter in all versions up to, and including, 6.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

CVE-2026-111577: Unknown GoSMTP: The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP…

The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP configuration page, which is gated only on the GoSMTP WordPress plugin before 1.2.5-activation capability, allowing users with a delegated role below administrator to change outbound ma...

PT-2026-127884

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cmb43ex1 grp0txt wysiwyg field inside group — field id controlled by integrator config' parameter in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. This makes...

CVE-2026-106003: Unknown Court Reservation: The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce…

The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its AJAX actions, allowing unauthenticated users to add or delete reservation types in the Court Reservation WordPress plugin before 1.12.4's configuration...