PT-2026-49351

Unauthenticated Cross Site Scripting XSS in Okay Toolkit = 2.3 versions...

Braille support module Privilege Escalation

The vulnerability of the Braille support module in the text-to-speech application for blind and visually impaired users like Narrator is related to the use of an unreliable search path. Exploiting this vulnerability can allow attackers to gain increased privileges...

PT-2026-49429

Subscriber Insecure Direct Object References IDOR in KiviCare = 4.2.1 versions...

CVE-2026-39468: Improper Limitation of a Pathname to a Restricted Directory

Contributor Arbitrary File Deletion in Meta Box – WordPress Custom Fields Framework = 5.11.1 versions...

PT-2026-49227

Name of the Vulnerable Software and Affected Versions Really Simple SSL versions prior to 9.6.0 Description Broken Access Control allows users with the Subscriber role to perform unauthorized actions. Recommendations Update to a version newer than 9.5.9...

CVE-2026-39449: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Contact Form to Any API = 3.0.3 versions...

PT-2026-49485

Name of the Vulnerable Software and Affected Versions WP Job Portal versions prior to 2.5.3 Description Cross Site Scripting XSS exists in the plugin, allowing users with the Subscriber role to execute malicious scripts in the browser of other users. Recommendations Update to a version newer than...

PT-2026-49484

Name of the Vulnerable Software and Affected Versions Visual Link Preview versions prior to 2.4.2 Description An issue in the plugin leads to the exposure of sensitive subscriber data. Recommendations Update to version 2.4.2 or later...

PT-2026-49644

Name of the Vulnerable Software and Affected Versions GEO my WordPress versions prior to 4.5.6 Description Unauthenticated SQL Injection allows an attacker to interfere with the queries that an application makes to its database, potentially allowing them to view data they are not normally able to...

PT-2026-49359

Unauthenticated Bypass Vulnerability in WpTravelly = 2.1.7 versions...

PT-2026-49379

Contributor PHP Object Injection in Post Duplicator = 3.0.10 versions...

PT-2026-49419

Unauthenticated Broken Access Control in Royal MCP = 1.4.2 versions...

PT-2026-49443

Unauthenticated Cross Site Scripting XSS in Favicon Rotator = 1.2.11 versions...

PT-2026-49520

Unauthenticated Sensitive Data Exposure in ABC Crypto Checkout = 1.8.2 versions...

PT-2026-49523

Subscriber SQL Injection in WCMultiShipping = 3.0.2 versions...

PT-2026-49494

Subscriber Sensitive Data Exposure in XCloner = 4.8.6 versions...

PT-2026-49502

Unauthenticated Broken Access Control in Hippoo Mobile App for WooCommerce = 1.9.5 versions...

PT-2026-49506

Unauthenticated Broken Access Control in Knit Pay = 9.4.0.0 versions...

PT-2026-49512

Unauthenticated Broken Authentication in RegistrationMagic = 6.0.8.6 versions...

PT-2026-49516

Name of the Vulnerable Software and Affected Versions Dokan versions prior to 5.0.3 Description A privilege escalation issue exists that allows a user with customer privileges to gain higher access levels. Recommendations Update to a version later than 5.0.2...