CVE-2026-18465

The WP MAPS PRO WordPress plugin (versions before 6.1.3 ) is vulnerable to an unauthenticated Local File Inclusion (LFI) . The root cause is a missing capability check in an AJAX action accessible to unauthenticated users, combined with a failure to properly validate a user-controlled path before...

CVE-2026-18465 WP Maps Pro < 6.1.3 - Unauthenticated Local File Inclusion

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include...

PT-2026-69274

Name of the Vulnerable Software and Affected Versions WP MAPS PRO versions prior to 6.1.3 Description An issue exists where the plugin fails to perform a capability check in an AJAX action available to unauthenticated users. Because the operation it dispatches is not restricted, unauthenticated...

CVE-2026-18464: Uncontrolled Resource Consumption

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts...

CVE-2026-18465: Improper Limitation of a Pathname to a Restricted Directory

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include...

PT-2026-69275

Name of the Vulnerable Software and Affected Versions WP MAPS PRO versions prior to 6.1.3 Description An issue exists where a capability check is missing in an AJAX action available to unauthenticated users. The plugin fails to properly validate a user-controlled path used in a file inclusion...

WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Visitor Traffic Real Time Statistics Pro versions = 11.10...

EUVD-2026-54325

Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-54202

The Event Booking Manager for WooCommerce Pro WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native non-WooCommerce checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows...

EUVD-2026-54200

Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites...

EUVD-2026-54300

The official MonsterInsights Pro update distribution bucket monster-insights.s3.amazonaws.com was compromised. Both the current release 10.2.2 and the version MonsterInsights rolled back to 10.2.0 contain a malicious file, class-system-check.php. Three distinct variants were observed on 2026-06-1...

CVE-2026-63508

Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network...

PT-2026-69056

Name of the Vulnerable Software and Affected Versions Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x Description An incorrect authorization issue exists in the repository-creation user interface. A user account with delegated repository-admin privileges for a specific repository format c...

CVE-2026-17594: Incorrect Authorization

Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability CWE-863 in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of...

CVE-2026-63508

Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-17032

Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites...

CVE-2026-11976

The official MonsterInsights Pro update distribution bucket monster-insights.s3.amazonaws.com was compromised. Both the current release 10.2.2 and the version MonsterInsights rolled back to 10.2.0 contain a malicious file, class-system-check.php. Three distinct variants were observed on 2026-06-1...

CVE-2026-16067

The CVE concerns the Event Booking Manager for WooCommerce (Pro) WordPress plugin, affected versions prior to 5.0.3. The vulnerability arises because the plugin does not validate the ticket price on the server during its native checkout, trusting the per-ticket price supplied by the client. As a ...

CVE-2026-16067 Event Booking Manager for WooCommerce (Pro) < 5.0.3 - Unauthenticated Payment Bypass via Client-Controlled Ticket Price

The Event Booking Manager for WooCommerce Pro WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native non-WooCommerce checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows...

CVE-2026-16067 Event Booking Manager for WooCommerce (Pro) < 5.0.3 - Unauthenticated Payment Bypass via Client-Controlled Ticket Price

The Event Booking Manager for WooCommerce Pro WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native non-WooCommerce checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows...