PT-2026-81400

The FluentCRM Pro – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.1.12 due to insufficient escaping on the user supplied parameter and lack of sufficient...

PT-2026-81864

Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session. The POST handler on challenge path keeps the failure count as tries inside the totp pending record ...

PT-2026-81175

The Fluent Support Pro plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized acti...

CVE-2026-78619: Authentication Bypass by Primary Weakness

Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totpuserecovery compares user identifiers numerically. The helper searches the recovery model for the submitted code's digest alone, across every user's rows, so the ownersh...

CVE-2025-9878: Improper Neutralization of Input During Web Page Generation

The PPWP – Password Protect WordPress | 1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppwp' shortcode in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied...

Linux Distros Unpatched Vulnerability : CVE-2026-78465

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes...

CVE-2026-56708: Time-of-check Time-of-use (TOCTOU) Race Condition

Grav API plugin before 1.0.16 contains a server-side request forgery vulnerability in webhook delivery that allows attackers to bypass hostname validation by DNS rebinding. Attackers controlling authoritative DNS for a configured webhook hostname can answer validation lookups with public addresse...

PT-2026-81250

Name of the Vulnerable Software and Affected Versions Kalles Addons versions prior to 1.0.7 Description The Kalles Addons plugin for WordPress is susceptible to PHP Object Injection due to the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. The...

PT-2026-81191

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor Strings Dropdown in all versions up to, and including, 3.2.6 due to insufficient input sanitization and...

PT-2026-81189

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field Save and Continue Draft in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes i...

PT-2026-81162

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cozyHoverEffect Block Attribute in all versions up to, and including, 2.2.16 due to insufficient input sanitization and output...

PT-2026-81169

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfp featured video url' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-81244

Name of the Vulnerable Software and Affected Versions Events 2 affected versions not specified Description The frontend management plugin contains a broken access control issue. The system attributes a newly created event to the submitting user's organizer record only if the request does not...

PT-2026-81142

Name of the Vulnerable Software and Affected Versions Grav Login plugin versions prior to 3.9.1 Description An issue exists where the registration endpoint allows for email address enumeration. The register function in classes/Login.php triggers a specific exception, EMAIL NOT AVAILABLE, when a...

PT-2026-81863

Name of the Vulnerable Software and Affected Versions Punk::Plugin::TOTP versions prior to 0.05 Description The software incorrectly validates recovery codes during the two-factor authentication challenge. The totp use recovery function searches the recovery model for a submitted code's digest...

FreeBSD : MariaDB -- Multiple vulnerabilities (f68670ea-a05d-11f1-8144-8447094a420f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the f68670ea-a05d-11f1-8144-8447094a420f advisory. The MariaDB project reports: Details in links Tenable has extracted the preceding description...

CVE-2026-75930: Missing Authorization

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

CVE-2026-78655: Improper Restriction of Excessive Authentication Attempts

Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session. The POST handler on challengepath keeps the failure count as tries inside the totppending record in...

CVE-2026-72699: Observable Discrepancy

The Grav Login plugin getgrav/grav-plugin-login before 3.9.1 is vulnerable to email address enumeration. The register method in classes/Login.php throws a distinct exception EMAILNOTAVAILABLE when a submitted email address already belongs to an existing account, while allowing registration to...

PT-2026-81146

The Grav Email plugin getgrav/grav-plugin-email before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig templates. An authenticated remote user with only api.access and api.pages.write permissions can place a Twig expression in header.form.process.email.body, publi...