CVE-2026-14287: Improper Neutralization of Input During Web Page Generation

The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing an unauthenticated attacker to store markup that executes as...

PT-2026-78297

Name of the Vulnerable Software and Affected Versions TrueBooker versions prior to 1.2.7 Description Lack of proper authorization checks in several AJAX actions allows unauthenticated users to retrieve personally identifiable information PII of customers who booked appointments. The exposed data...

PT-2026-78337

Name of the Vulnerable Software and Affected Versions TrueBooker versions prior to 1.2.7 Description An issue exists that allows unauthenticated users to perform privilege escalation. Recommendations Update to a version newer than 1.2.6...

PT-2026-78335

Unauthenticated Cross Site Scripting XSS in Global Gallery = 11.1.2 versions...

PT-2026-78342

Name of the Vulnerable Software and Affected Versions Outranking Plugin versions prior to 1.1.4 Description Broken access control allows unauthenticated users to access the options of the Outranking Plugin. Recommendations Update to a version newer than 1.1.3...

PT-2026-78344

Unauthenticated Local File Inclusion in Resido = 1.5 versions...

PT-2026-78287

Name of the Vulnerable Software and Affected Versions Product Shortlist WordPress plugin versions prior to 1.0.5 Description An issue exists where a parameter is not properly sanitized and escaped before being used in a SQL statement. This allows unauthenticated attackers to execute SQL injection...

PT-2026-78347

Name of the Vulnerable Software and Affected Versions Total Donations versions prior to 2.0.6 Description An issue allows unauthenticated users to perform privilege escalation. Recommendations Update to a version newer than 2.0.5...

PT-2026-78338

Unauthenticated Cross Site Scripting XSS in SimplyRETS Real Estate IDX = 3.2.8 versions...

PT-2026-79297

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce versions prior to 2.12.1 Description This issue occurs because the software fails to regenerate the session identifier during authentication and accepts a session identifier provided via a user-supplied request parameter. Th...

CVE-2026-18231: Exposure of Sensitive Information to an Unauthorized Actor

The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve the usernames and email addresses of users holding the WP Directory Kit WordPress plug...

CVE-2026-18031: Improper Authentication

The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator...

PT-2026-78304

Name of the Vulnerable Software and Affected Versions KiviCare versions prior to 4.5.4 Description An Insecure Direct Object Reference IDOR exists where the software fails to verify if the requesting user has the necessary permissions to access a specific media file. This allows authenticated use...

PT-2026-78299

Name of the Vulnerable Software and Affected Versions Broken Link Checker versions prior to 2.4.12 Description On sites using plain permalinks, the plugin fails to limit the query variables accepted from user input. This allows unauthenticated users to overwrite arbitrary PHP global variables and...

CVE-2025-11729 PPWP: Password Protect Pages, Posts & Full or Partial Content <= 1.9.15 - Improper Authorization To Authenticated (Contributor+) Master Password Exposure

The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the canaccess function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with...

CVE-2026-66589

Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKing: from n/a through 5.2.30...

CVE-2026-66591

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. This issue affects Media LIbrary Assistant: from n/a through 3.39...

CVE-2026-27365

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series: from n/a through 2.17.0...

CVE-2026-27365 WordPress PublishPress Series plugin <= 2.17.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series: from n/a through 2.17.0...

CVE-2026-27365

The WordPress PublishPress Series plugin (versions through 2.17.0) has a stored XSS flaw from improper input neutralization during page generation. Patchstack rates it MEDIUM (CVSS 5.9) requiring high privileges and user interaction. No exploitation data is provided. Upgrade to a patched version ...