PT-2026-78301

Name of the Vulnerable Software and Affected Versions ProSolution WP Client versions prior to 2.0.11 Description Insufficient sanitization and escaping of the page parameter on an administrative page allows for reflected Cross-Site Scripting XSS. This occurs when an administrator is induced to...

PT-2026-78284

Name of the Vulnerable Software and Affected Versions NextScripts: Social Networks Auto-Poster WordPress plugin versions prior to 4.4.8 Description Reflected Cross-Site Scripting XSS occurs when an application includes untrusted data in a web page without proper validation or escaping. The plugin...

PT-2026-73209

The WooMS WordPress plugin through 9.14 does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integration credentials to every such request, allowing unauthenticated attackers to perform Server-Side Request Forgery and to disclose the...

PT-2026-76767

Name of the Vulnerable Software and Affected Versions Forminator versions prior to the patch released in response to this disclosure Description An unauthenticated arbitrary file upload flaw allows an attacker to upload malicious PHP files to the server, leading to Remote Code Execution RCE, whic...

PT-2026-77041

Name of the Vulnerable Software and Affected Versions Sync Post With Other Site versions prior to 1.9.4 Description The Sync Post With Other Site plugin for WordPress allows authenticated attackers with contributor-level access and above to upload arbitrary files to the server. This issue occurs...

PT-2026-78271

Name of the Vulnerable Software and Affected Versions Dinatur WordPress plugin versions prior to 1.19 Description Unauthenticated users can perform SQL injection attacks because user input is not sanitized or escaped before being used in a SQL query. Additionally, a handler allows unauthenticated...

PT-2026-78279

Name of the Vulnerable Software and Affected Versions Quiz and Survey Master QSM WordPress plugin versions prior to 11.2.4 Description Insufficient per-object ownership verification occurs when saving front-end text settings for a quiz. This allows users with contributor-level access or higher to...

PT-2026-78281

Name of the Vulnerable Software and Affected Versions User Verification by PickPlugins WordPress plugin versions prior to 2.0.48 Description The plugin fails to verify if a request to resend a verification email is authorized for the specified user and does not bind the protection token to that...

CVE-2024-13784 Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object Injection

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

CVE-2026-2497

The Gallery by BestWebSoft plugin for WordPress is vulnerable to SQL Injection via the 'galleryorderpostid' parameter array keys in all versions up to, and including, 4.7.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-10734

The Infility Global plugin for WordPress is vulnerable to Stored Cross-Site Scripting via /cf7record Log Endpoint in all versions up to, and including, 2.15.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-18347

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.1.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-17608

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.10.09. This is due to missing or incorrect nonce validation on the top-level template code function. This makes it possible for...

CVE-2026-12998

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.55.0.2 via the 'draft' parameter due to missing validation on a user controlled key. This makes it possible for...

CVE-2026-18347

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.1.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-17604 Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read...

CVE-2026-17604

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read...

CVE-2026-2497 Gallery by BestWebSoft <= 4.7.9 - Authenticated (Editor+) SQL Injection via Gallery Image Order Array Keys

The Gallery by BestWebSoft plugin for WordPress is vulnerable to SQL Injection via the 'galleryorderpostid' parameter array keys in all versions up to, and including, 4.7.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-2497

The CVE concerns The Gallery by BestWebSoft plugin for WordPress, affecting all versions up to 4.7.9. The vulnerability is an SQL Injection via the gallery_order {post_id} parameter array keys, arising from unsanitized array keys stored from $_POST into post meta and later injected into SQL queri...

EUVD-2026-59925

The Gallery by BestWebSoft plugin for WordPress is vulnerable to SQL Injection via the 'galleryorderpostid' parameter array keys in all versions up to, and including, 4.7.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...