PT-2026-95222

Name of the Vulnerable Software and Affected Versions RT Mega Menu versions prior to 1.5.2 Description Insufficient input sanitization and output escaping allow authenticated attackers with Subscriber-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting...

CVE-2026-14855: Improper Neutralization of Input During Web Page Generation

The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cssleft' parameter in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access a...

CVE-2026-12954: Improper Input Validation

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the myprofileupdate function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplie...

CVE-2026-89138: Missing Authorization

The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-93031: Unrestricted Upload of File with Dangerous Type

The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the downloadfiletouploads function. This is due to the import action being registered for...

CVE-2026-18317: Missing Authorization

The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

CVE-2026-91010

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action, and only tests that a nonce parameter is present rather than validating it, allowing any authenticated user, such as a...

PT-2026-94177

Name of the Vulnerable Software and Affected Versions Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin versions prior to 5.1.1 Description An issue exists in the message deletion AJAX action where the software fails to verify user capabilities and only checks f...

CVE-2026-91010: Missing Authorization

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action, and only tests that a nonce parameter is present rather than validating it, allowing any authenticated user, such as a...

CVE-2026-87828: Uncontrolled Resource Consumption

The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire...

CVE-2026-87959: Improper Access Control

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI...

CVE-2026-78088: Unrestricted Upload of File with Dangerous Type

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it...

WordPress Blog2Social: Social Media Auto Post & Scheduler plugin <= 9.0.0 - Authenticated (Subscriber+) Username Enumeration vulnerability

Authenticated Subscriber+ Username Enumeration vulnerability discovered by Choriyev Qahramon in WordPress Plugin Blog2Social versions = 9.0.0...

CVE-2026-14805

The Consulting WordPress theme (Consulting – Business, Finance WordPress Theme) is affected by an authenticated privilege escalation in versions up to and including 6.7.16 . Two combined flaws enable the attack: the masterstudy_ms_stm_set_discard_transient AJAX endpoint in admin/admin-notices/cla...

CVE-2026-89141: Authorization Bypass Through User-Controlled Key

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.7 via the 'mediaId' parameter due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2026-88912

The rtMedia for WordPress, BuddyPress and bbPress plugin (versions before 4.7.12 ) is vulnerable to an IDOR (Insecure Direct Object Reference) issue. The software fails to verify ownership when changing the privacy level of an activity and its associated media, relying instead on a nonce shared w...

CVE-2026-88912: Authorization Bypass Through User-Controlled Key

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to...

CVE-2026-77161: Improper Neutralization of Special Elements used in an SQL Command

The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-85198: Improper Neutralization of Special Elements used in an SQL Command

The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-15451: Improper Privilege Management

The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the 'addsubaccountuser' function that passes the raw 'userdata' array to 'wpinsertuser' without filtering...