PT-2026-81959

The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a subscriber, to read other projects' task content and user email addresses and to modify other projects' task boards...

PT-2026-81956

The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the multiple blocks in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-81948

The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secr...

PT-2026-81967

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files...

PT-2026-81946

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks...

PT-2026-81950

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frm user id' parameter in all versions up to, and including, 6.33.1 due to insufficient input sanitization and output escaping...

PT-2026-81968

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and billing information...

PT-2026-81954

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

PT-2026-81963

The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be deleted, allowing users with the Shop Manager role and above to delete arbitrary files on the server, which could lead to the si...

PT-2026-81962

The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anonymous visitors, allowing unauthenticated attackers to run AI queries of their own choosing against the site owner's...

PT-2026-81958

The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting...

PT-2026-81949

The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price...

PT-2026-81977

The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi...

PT-2026-82078

Name of the Vulnerable Software and Affected Versions Grav API plugin getgrav/grav-plugin-api versions prior to 1.0.18 Description The injectSecurityTab function within the BlueprintController fails to apply the API-key scope cap when determining if a page's security or permissions blueprint...

PT-2026-82077

Name of the Vulnerable Software and Affected Versions getgrav/grav-plugin-api versions prior to 1.0.18 Description The getgrav/grav-plugin-api plugin fails to enforce API-key scope within the requireNotSuperTarget function located in UsersController.php across seven sensitive user-management...

PT-2026-82049

Name of the Vulnerable Software and Affected Versions Reviews and Rating – Google Reviews plugin for WordPress versions prior to 5.11 Description Stored Cross-Site Scripting occurs because the wp display shortcode handler allows attacker-controlled html tags values to define raw HTML tags and emb...

PT-2026-82097

Name of the Vulnerable Software and Affected Versions Formidable Charts versions prior to 2.0.2 Description An issue exists that allows unauthenticated attackers to perform Directory Traversal, a method used to access files and directories that are stored outside the web root folder. By...

PT-2026-82210

Name of the Vulnerable Software and Affected Versions SunEditor versions prior to 3.1.4 Description A DOM-based Cross-Site Scripting XSS issue exists in the SunEditor Embed plugin within src/plugins/modal/embed.js. The plugin uses DOMParser to parse raw embed HTML and processes the resulting DOM...

WPProbe Plugin Enumeration Tool 0.12.11

A fast WordPress plugin and theme scanner that detects installed plugins via REST API enumeration and themes from HTML discovery, then maps them to known vulnerabilities. Over 5,000 plugins detectable without brute-force, thousands more with it...

CVE-2026-19094: Improper Neutralization of Special Elements used in an SQL Command

The Tutor LMS WordPress plugin before 4.0.6 does not validate values used to build a database query, and does not restrict which template file a request may load, allowing unauthenticated users to inject SQL and to read question and answer content belonging to courses that are not publicly...