EUVD-2026-53984

Shop manager Privilege Escalation in Order Delivery Date for WooCommerce = 4.6.0 versions...

EUVD-2026-53942

Unauthenticated PHP Object Injection in Ajax Search Lite = 4.14.4 versions...

CVE-2026-9273

The Membership Plugin – Kadence Memberships plugin for WordPress formerly Restrict Content is vulnerable to password reset link poisoning leading to account takeover in all versions up to, and including, 4.0.0. This is due to the legacy lost-password handler rcprocesslostpasswordform consuming th...

CVE-2026-9273

Kadence Memberships (WordPress) up to version 4.0.0 is vulnerable to unauthenticated password-reset link poisoning due to rc_process_lost_password_form() feeding attacker-controlled rc_redirect into two unvalidated sinks in legacy/includes/forms.php (wp_redirect/esc_url and add_query_arg). The pu...

NPM: Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass

NPM: Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass vulnerability discovered by ? in WordPress Npm apostrophe versions = 4.30.0...

PT-2026-64939

Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...

EUVD-2026-48510

The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'backend-title' parameter in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2026-65526

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themeisle Visualizer allows Blind SQL Injection. This issue affects Visualizer: from n/a through 4.0.1...

CVE-2026-65526 WordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themeisle Visualizer allows Blind SQL Injection. This issue affects Visualizer: from n/a through 4.0.1...

CVE-2026-65473

CVE-2026-65473 affects the WordPress Virtue/Ascend/Pinnacle Toolkit plugin (versions

WordPress Kwayy HTML Sitemap plugin <= 4.0 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Kwayy HTML Sitemap versions = 4.0...

PT-2026-63830

Subscriber Cross Site Scripting XSS in Slider Pro = 4.8.13 versions...

PT-2026-63891

Unauthenticated Broken Access Control in AWP Classifieds = 4.4.7 versions...

CVE-2026-15802

The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'deletelocationsbackupfilecallback' function in all versions up to, and including, 4.9. This makes it possible for authenticated attackers, with subscriber-level access...

EUVD-2026-44888

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via Stored Quiz Answer Array in all versions up to, and including, 4.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...

CVE-2026-57798

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in SaurabhSharma NewsPlus Shortcodes newsplus-shortcodes allows PHP Local File Inclusion.This issue affects NewsPlus Shortcodes: from n/a through = 4.2.0...

EUVD-2026-43393

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Zorem Advanced Shipment Tracking for WooCommerce woo-advanced-shipment-tracking allows Blind SQL Injection.This issue affects Advanced Shipment Tracking for WooCommerce: from n/a through = 4.0...

CVE-2026-57412 WordPress Gift Vouchers plugin <= 4.6.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in Codemenschen Gift Vouchers gift-voucher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gift Vouchers: from n/a through = 4.6.9...

CVE-2026-57375 WordPress MStore API plugin <= 4.18.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in FluxBuilder MStore API mstore-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MStore API: from n/a through = 4.18.4...

PT-2026-57119

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to generic SQL Injection via the 'lang' parameter in all versions up to, and including, 4.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...