CVE-2026-49058: Incorrect Privilege Assignment

Unauthenticated Privilege Escalation in LoginPress Pro = 6.2.2 versions...

PT-2026-50295

Subscriber Broken Access Control in MetForm Pro = 3.9.1 versions...

PT-2026-50276

Name of the Vulnerable Software and Affected Versions WPBot Pro Wordpress Chatbot versions prior to 13.6.6 Description A subscriber can perform arbitrary file deletion within the software...

PT-2026-50341

Unauthenticated Cross Site Scripting XSS in WPFunnels Pro = 2.9.4 versions...

CVE-2026-24610: Missing Authorization

Subscriber Broken Access Control in MetForm Pro = 3.9.1 versions...

PT-2026-50344

Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms = 1.4.5 versions...

CVE-2026-52705: Unrestricted Upload of File with Dangerous Type

Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms = 1.4.5 versions...

PT-2026-50296

Unauthenticated Broken Access Control in MetForm Pro = 3.9.1 versions...

CVE-2026-24611: Missing Authorization

Unauthenticated Broken Access Control in MetForm Pro = 3.9.1 versions...

PT-2026-50327

Unauthenticated Cross Site Scripting XSS in Profile Builder Pro = 3.15.0 versions...

PT-2026-50403

Unauthenticated Cross Site Scripting XSS in Royal Elementor Addons Pro 1.7.1041 versions...

CVE-2026-40783: Improper Control of Generation of Code

Contributor Remote Code Execution RCE in Blocksy Companion Pro = 2.1.37 versions...

CVE-2026-39596: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Blocksy Companion Pro 2.1.29 versions...

PT-2026-50328

Unauthenticated Broken Authentication in PowerPack Pro for Elementor v2.13.0 versions...

PT-2026-50313

CP Client Arbitrary File Download in Client Portal Pro = 5.6.2 versions...

CVE-2026-40720: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Royal Elementor Addons Pro 1.7.1041 versions...

CVE-2026-25470: Improper Control of Generation of Code

Unauthenticated Remote Code Execution RCE in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.47 versions...

CVE-2026-49778: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WPFunnels Pro = 2.9.4 versions...

PT-2026-50286

Unauthenticated SQL Injection in Tutor LMS Pro = 3.9.6 versions...

CVE-2026-22332: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Tutor LMS Pro = 3.9.6 versions...