CVE-2025-66428

The WebPros WordPress Toolkit (prior to version 6.9.1 ) is vulnerable to a privilege escalation flaw. The root cause involves issues with how WordPress directory names are handled, specifically through the manipulation of directory names . This vulnerability could allow an attacker to gain elevat...

PT-2026-4274

Name of the Vulnerable Software and Affected Versions WordPress Toolkit versions prior to 6.9.1 Description A flaw exists in WordPress directory names within WebPros WordPress Toolkit that can lead to privilege escalation. The issue involves manipulation of directory names. Recommendations Update...

CVE-2025-66431: UNIX Symbolic Link (Symlink) Following

WebPros Plesk before 18.0.73.5 and 18.0.74 before 18.0.74.2 on Linux allows remote authenticated users to execute arbitrary code as root via domain creation. The attacker needs "Create and manage sites" with "Domains management" and "Subdomains management."...