PT-2026-48750

Unauthenticated Broken Authentication in Booknetic = 4.8.5 versions...

PT-2026-48752

Unauthenticated Cross Site Scripting XSS in Product Filter Widget for Elementor = 1.0.6 versions...

PT-2026-48751

Unauthenticated Cross Site Scripting XSS in WP Google Review Slider = 18.0 versions...

PT-2026-46349

Unauthenticated Arbitrary File Deletion in Car Zone = 3.7 versions...

PT-2026-46323

Unauthenticated Local File Inclusion in Imba = 1.5.0 versions...

PT-2026-46324

Unauthenticated Local File Inclusion in Rosaleen = 2.8 versions...

PT-2026-46354

Unauthenticated Local File Inclusion in Gat = 1.16 versions...

PT-2026-46380

Unauthenticated Local File Inclusion in Roneous = 2.1.5 versions...

PT-2026-46343

Unauthenticated PHP Object Injection in Plumbing = 1.6 versions...

PT-2026-46371

Unauthenticated Local File Inclusion in Eros = 1.3 versions...

PT-2026-46361

Unauthenticated Local File Inclusion in Gamic = 1.15 versions...

PT-2026-46330

Unauthenticated Local File Inclusion in Nexio = 1.10.0 versions...

PT-2026-46340

Unauthenticated Local File Inclusion in Especio = 1.0 versions...

PT-2026-46334

Unauthenticated Local File Inclusion in Ingenioso = 1.14.0 versions...

PT-2026-46365

Unauthenticated Local File Inclusion in Snowy = 1.13 versions...

PT-2026-46351

Unauthenticated Local File Inclusion in Abelle = 1.22 versions...

PT-2026-46333

Unauthenticated Local File Inclusion in Iona = 1.0.8 versions...

CVE-2026-27047 WordPress Curly Core plugin <= 2.1.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Mikado-Themes Curly Core curly-core allows PHP Local File Inclusion.This issue affects Curly Core: from n/a through = 2.1.6...

Exploit for CVE-2025-8489

100-days-challenge-day-21--WP scan WP Scan helped identify co...

CVE-2025-5092 Multiple Plugins and Themes <= (Various Versions) - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript Library

Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled lightGallery library = 2.8.3 in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...