CVE-2026-96766: Improper Neutralization of Input During Web Page Generation

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businesshours' parameter in all versions up to, and including, 2.8.183 due to insufficient input sanitization and output escaping. This make...

CVE-2026-93656: Improper Neutralization of Input During Web Page Generation

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it...

PT-2026-98395

Name of the Vulnerable Software and Affected Versions wpForo Forum versions prior to 3.1.7 Description Stored Cross-Site Scripting occurs via the 'telegram' profile field due to insufficient input sanitization and output escaping in the profile update action. The raw $ POST'data' array is copied...

PT-2026-98379

Name of the Vulnerable Software and Affected Versions GeoDirectory versions prior to 2.8.184 Description The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input...

CVE-2026-13179: Improper Neutralization of Input During Web Page Generation

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shapesvalues Parameter in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes ...

CVE-2026-93899: Improper Neutralization of Special Elements used in an SQL Command

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'groupid' Message Meta Parameter in all versions up to, and including, 3.0.4 due to insufficient escaping on the user supplied parameter and lack of...

WordPress OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin plugin <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Disclosure vulnerability discovered by Wordfence PRISM in WordPress Plugin Desktop Mode versions = 1.1.7...

CVE-2026-89002

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize and escape content it retrieves from a user-supplied source before rendering it, which could allow users such as contributors to perform Stored Cross-Site Scripting attacks against higher-privileged users who review t...

CVE-2026-80513

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum...

CVE-2026-80338

The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to create arbitrary WordPress options and corrupt existing ones, which can break core site settings and take the site offline. Exploitation...

CVE-2026-93662

The Events Manager WordPress plugin, in versions prior to 7.4.5 , is vulnerable to an unauthorized data disclosure flaw. The application fails to enforce proper scope for logged-in event and location searches when a caller provides a custom owner value . This allows a low-privileged user to read ...

CVE-2026-93662 Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter

The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street...

CVE-2026-88847 MasterStudy LMS < 3.7.50 - Subscriber+ Lesson Completion Record Creation

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course before recording lesson completions against it, allowing any authenticated user, such as a subscriber, to create course progress records for courses they have no access to...

CVE-2026-88847 MasterStudy LMS < 3.7.50 - Subscriber+ Lesson Completion Record Creation

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course before recording lesson completions against it, allowing any authenticated user, such as a subscriber, to create course progress records for courses they have no access to...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.50 - Subscriber+ Lesson Completion Record Creation vulnerability

Subscriber+ Lesson Completion Record Creation vulnerability discovered by Arman Kumar in WordPress Plugin MasterStudy LMS versions 3.7.50...

CVE-2026-88845

The MasterStudy LMS WordPress Plugin versions before 3.7.50 is vulnerable to an unauthorized action due to a lack of capability or nonce checks on an administrative maintenance action. This flaw allows any authenticated user , such as a subscriber, to trigger the action and create published conte...

CVE-2026-88845 MasterStudy LMS 2.3.0 - < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own accoun...

CVE-2026-82849 Masteriyo LMS < 3.4.2 - Subscriber+ Arbitrary User Course Progress Disclosure via IDOR

The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticated user, such as a self-registered subscriber, to read another user's learning activity. The ownership check it applies is...

CVE-2026-82849

The Masteriyo LMS WordPress plugin, versions prior to 3.4.2 , is vulnerable to an IDOR (Insecure Direct Object Reference) flaw. The plugin fails to verify that the authenticated user owns the course-progress records they are requesting. Specifically, the ownership check is bypassed when the reque...

CVE-2026-82849 Masteriyo LMS < 3.4.2 - Subscriber+ Arbitrary User Course Progress Disclosure via IDOR

The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticated user, such as a self-registered subscriber, to read another user's learning activity. The ownership check it applies is...