PT-2026-79517

Name of the Vulnerable Software and Affected Versions Social Login & Sharing buttons with Analytics By SoClever versions prior to 1.2.1 Description The plugin fails to perform authentication, authorization, or nonce checks in a publicly accessible login handler. This allows unauthenticated...

PT-2026-78962

Author Arbitrary File Upload in Media LIbrary Assistant = 3.39 versions...

PT-2026-79506

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.0.6 Description The plugin fails to enforce per-object ownership checks on its course content type. This allows users with the instructor role to access and read the content of private courses created by other...

PT-2026-78978

Name of the Vulnerable Software and Affected Versions Leyka versions prior to 3.32.4 Description Broken authentication exists for subscribers, allowing potential unauthorized access to accounts. Recommendations Update to a version newer than 3.32.3...

PT-2026-78890

Name of the Vulnerable Software and Affected Versions Depicter — Popup & Slider Builder WordPress plugin versions prior to 4.8.0 Description Users with editor-level access can upload arbitrary files, including executable PHP scripts, into a web-accessible directory. This occurs because the import...

PT-2026-78957

Unauthenticated SQL Injection in Security & Malware scan by CleanTalk = 2.184 versions...

PT-2026-78895

Name of the Vulnerable Software and Affected Versions JSON Options versions prior to 0.0.5 Description The JSON Options WordPress plugin lacks capability checks and nonce verification on an action that executes on every request. This allows unauthenticated users to update arbitrary WordPress...

PT-2026-78980

Name of the Vulnerable Software and Affected Versions Abandoned Cart Pro for WooCommerce versions prior to 10.4.1 Description An issue allows unauthenticated users to perform privilege escalation. Recommendations Update Abandoned Cart Pro for WooCommerce to version 10.4.1 or later...

PT-2026-78888

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the eme single event page template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrar...

PT-2026-78991

Name of the Vulnerable Software and Affected Versions Warehouse Cargo versions prior to 2.7.0 Description An issue allows subscribers to perform arbitrary file uploads, which could lead to the upload of unauthorized files to the server. Recommendations Update to a version newer than 2.6.9...

PT-2026-78990

Name of the Vulnerable Software and Affected Versions Smart Cleaning versions prior to 4.8.7 Description An arbitrary file upload issue exists that allows users with subscriber privileges to upload unauthorized files to the system. Recommendations Update to a version newer than 4.8.6...

PT-2026-78981

Unauthenticated Cross Site Scripting XSS in NotificationX Pro = 3.1.4 versions...

PT-2026-78971

Unauthenticated Cross Site Scripting XSS in SEO Plugin by Squirrly SEO = 14.2.2 versions...

PT-2026-78984

Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...

PT-2026-78953

Unauthenticated PHP Object Injection in Forminator = 1.57.0 versions...

CVE-2026-75860: Improper Privilege Management

The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and is available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user...

PT-2026-79516

Name of the Vulnerable Software and Affected Versions WP Social Media Login versions prior to 1.0.7 Description The WP Social Media Login WordPress plugin fails to verify if a social login process was successfully completed with the identity provider before authenticating a visitor. This allows...

NPM: SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses

NPM: SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses vulnerability discovered by ? in WordPress Npm mcp-searxng versions 1.12.0...

CVE-2026-18315

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the adminusercreatecus AJAX handler lacking any authentication o...

CVE-2026-32475 WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1...