PT-2026-89449

Unauthenticated Cross Site Scripting XSS in WPAdverts = 2.3.3 versions...

PT-2026-89444

Subscriber Settings Change in WP-Stateless = 4.4.1 versions...

PT-2026-89758

Name of the Vulnerable Software and Affected Versions The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPress versions prior to 2.10.3 Description Stored Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping...

PT-2026-89297

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or...

CVE-2026-77770: Missing Authorization

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every...

CVE-2026-19840: Incorrect Authorization

The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo...

CVE-2026-82925: Deserialization of Untrusted Data

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or...

CVE-2026-77771: Improper Authentication

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a...

PT-2026-89290

The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo...

PT-2026-89450

Unauthenticated Broken Access Control in WP Fast Total Search = 1.82.284 versions...

PT-2026-89280

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulk action parameter in all versions up to, and including, 1.15.46 due to insufficient input sanitization and output escaping. This makes it...

PT-2026-89337

The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

WordPress Aruba HiSpeed Cache plugin <= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin Aruba HiSpeed Cache versions = 3.0.14...

Exploit for SQL Injection in Wpfastestcache Wp_Fastest_Cache

CVE-2023-6063 — WP Fastest Cache SQL Injection PoC !Python...

WordPress Easy Google Fonts plugin <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Kitch in WordPress Plugin Easy Google Fonts versions = 2.0.4...

WordPress Advanced Contact form 7 DB plugin <= 2.1.3 - Missing Authorization to Authenticated (Custom+) Unauthorized Data Import vulnerability

Missing Authorization to Authenticated Custom+ Unauthorized Data Import vulnerability discovered by Jiang CY in WordPress Plugin Advanced Contact form 7 DB versions = 2.1.3...

WordPress WP BackItUp Community Edition plugin <= 2.1.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read vulnerability

Authenticated Administrator+ Path Traversal to Arbitrary File Read vulnerability discovered by Nikola Kojic in WordPress Plugin WP BackItUp versions = 2.1.0...

CVE-2026-82530

IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to circumvent IP-based restrictions by forging the X-Real-IP HTTP header. Attackers can set the X-Real-IP header to an allowlisted IP address...

CVE-2026-26212

Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wphandleupload that disables WordPress core's file type validati...

EUVD-2026-75028

Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wphandleupload that disables WordPress core's file type validati...