CVE-2026-16294

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a server-side request with it, allowing users with a role as low as Contributor to perform Server-Side Request Forgery attacks that can target...

CVE-2026-16066 Welcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product Name

The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page...

CVE-2026-16066

CVE-2026-16066 affects the Welcart e-Commerce WordPress plugin prior to version 2.11.34. The root cause is failure to sanitize or escape a product field before it is output on product pages, which enables users with the Author role and above to inject arbitrary web scripts that execute in visitor...

EUVD-2026-57086

The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page...

CVE-2026-15249

The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element...

CVE-2026-13613

The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injection...

CVE-2026-14857

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns...

CVE-2026-13613 KiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint

The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injection...

CVE-2026-13168

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses...

EUVD-2026-57072

The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in...

CVE-2026-64954

Velociraptor vulnerability CVE-2026-64954 arises because the COLLECT_CLIENT permission is not enforced when a user can run a VQL query that resets the authorization provider. This lets a user who can execute arbitrary VQL (typically an analyst) trigger new collections that normally require the in...

EUVD-2026-57068

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECTCLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run...

WP < 7.0.4 - Author+ RCE via PDF Upload

Description WordPress does not properly validate PDF files before generating thumbnail when the PHP Imagick extension and GhostScript are used, which could allow users with a role of author and above to upload malicious PDF filer containing php code and lead to RCE...

PT-2026-71250

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An information disclosure issue exists in the '/api/asset/getFileAnnotation' endpoint. The endpoint returns .sya PDF-annotation file content without performing a publish-access check, as it is only...

PT-2026-70995

Name of the Vulnerable Software and Affected Versions Velociraptor affected versions not specified Description Velociraptor allows scheduling new collections via VQL queries in notebooks. While scheduling a new collection typically requires the COLLECT CLIENT permission, this requirement is not...

PT-2026-71144

Name of the Vulnerable Software and Affected Versions Semaphore UI versions prior to 2.18.19 Semaphore UI versions 2.19.0-alpha3 through 2.19.5-beta5 Description ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use the 'POST /api/project/id/roles' endpoint to create a...

PT-2026-71198

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without...

PT-2026-71233

SiYuan v3.7.4-alpha.1 a pre-release; the endpoint does not exist in stable v3.7.3 or earlier contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role...

PT-2026-71029

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the...

PT-2026-71013

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a server-side request with it, allowing users with a role as low as Contributor to perform Server-Side Request Forgery attacks that can target...