99766 matches found
PT-2026-83403
Name of the Vulnerable Software and Affected Versions User Profile Builder WordPress plugin versions prior to 4.0.1 Description Insufficient validation of deserialized data occurs when importing a configuration file, which allows high privilege users, such as administrators, to perform PHP Object...
PT-2026-83392
Name of the Vulnerable Software and Affected Versions MemberHero WordPress plugin versions prior to 7.0 Description The plugin fails to restrict account fields during the frontend registration process. This allows unauthenticated attackers to register a new user with an arbitrary role, such as...
PT-2026-83399
Name of the Vulnerable Software and Affected Versions MStore API versions prior to 4.21.1 Description The MStore API WordPress plugin fails to verify if the order targeted by a delivery endpoint belongs to the user making the request. This allows any authenticated user, including those with...
PT-2026-83400
Name of the Vulnerable Software and Affected Versions MStore API versions prior to 4.21.1 Description The MStore API WordPress plugin fails to verify if the order targeted by its wallet payment handling belongs to the requester. Additionally, it does not deduct the wallet balance for most payment...
PT-2026-83424
The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handle form submission function. This is due to the plugin dynamically granting the unfiltered upload capability to all users during form submissions and bypassing...
PT-2026-83394
Name of the Vulnerable Software and Affected Versions Uix UserCenter versions prior to 1.0.4 Description The Uix UserCenter WordPress plugin fails to verify if the account being modified during an unauthenticated profile-update action belongs to the requester. The process uses a token for...
PT-2026-83401
Name of the Vulnerable Software and Affected Versions Catfolders Document Gallery Pro versions prior to 2.0.7 Description Certain REST API routes lack proper authorization, and the token used to identify requested content can be forged on the client side. This allows unauthenticated users to list...
PT-2026-83398
Name of the Vulnerable Software and Affected Versions Newsletters WordPress plugin versions prior to 4.17 Description Cross-Site Request Forgery CSRF occurs because the plugin fails to perform nonce or capability checks when saving settings screens. This allows an attacker to trick a logged-in...
PT-2026-83393
Name of the Vulnerable Software and Affected Versions Rest Routes WordPress plugin versions prior to 5.5.6 Description An issue exists where a value taken from the URL of a public REST route is not properly sanitized or validated before being used in a SQL query. This allows unauthenticated...
PT-2026-83395
Name of the Vulnerable Software and Affected Versions SmartAIPress versions prior to 1.2.1 Description Users with subscriber-level access and above can perform a full-read Server-Side Request Forgery SSRF, a condition where an attacker forces a server to make requests to an unintended location...
CVE-2026-10522: Improper Privilege Management
The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process, allowing unauthenticated attackers to register a new user with an arbitrary role, including Administrator, leading to a full site takeover. Version 6.9 is...
PT-2026-83415
Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.42 Description An Insecure Direct Object Reference IDOR exists where the plugin fails to correctly restrict access to order information. This allows users with the instructor role to acces...
PT-2026-83405
Name of the Vulnerable Software and Affected Versions Appointment Booking Calendar Plugin and Scheduling Plugin versions prior to 1.6.3 Description This issue occurs when the plugin fails to verify the actual amount paid against the server-side price staged for a booking during the confirmation o...
PT-2026-83414
Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.40 Description An issue exists where the plugin fails to verify the amount, receiver, currency, or status of a payment notification before marking an order as completed. This allows...
CVE-2026-17522: Cross-Site Request Forgery (CSRF)
The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin...
PT-2026-83413
Name of the Vulnerable Software and Affected Versions WP Ultimate CSV Importer versions prior to 9.0 Description Insufficient sanitization and escaping of imported field values before their use in a SQL statement allows high privilege users, such as administrators, to perform SQL injection attack...
PT-2026-83406
Name of the Vulnerable Software and Affected Versions HEL Online Classroom: AI-powered Online Classrooms versions prior to 1.0.4 Description The plugin fails to perform authorization checks on a REST API route. This allows unauthenticated users to retrieve stored settings, which include the share...
CVE-2026-39070
WordPress plugin Bit Assist before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged role admin can exploit this to redirect user to malicious site or control the account...
NPM: 9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF
NPM: 9router: Unauthenticated /v1 proxy access via Host-header spoofing → open AI relay + SSRF vulnerability discovered by ? in WordPress Npm 9router versions 0.5.2...