CVE-2026-15602 NEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameter

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-14498 Query Wrangler <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter

The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wpajaxqwformajax handler, combined with unsanitized...

CVE-2026-18385 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field

The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.19. This is due to the software allowing users to execute an...

CVE-2026-18385 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field

The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.19. This is due to the software allowing users to execute an...

EUVD-2026-59853

The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.19. This is due to the software allowing users to execute an...

CVE-2026-18432 Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...

EUVD-2026-59849

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...

CVE-2026-12905 Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment method of the Mobile Staff Cabinet API resource=appointment, action=booklymobilestaffcabinet in...

CVE-2026-18432 Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...

CVE-2026-2487

The Admin Custom Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2026-2487

CVE-2026-2487 concerns the WordPress plugin “Admin Custom Login.” The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in admin settings, affecting all versions up to and including 3.6.4. The root cause is insufficient input sanitization and output escaping, allowing an authenticated att...

PT-2026-73134

Name of the Vulnerable Software and Affected Versions WP Compress – Instant Performance & Speed Optimization versions prior to 7.10.10 Description This issue is a Cross-Site Request Forgery CSRF, which occurs when a malicious actor tricks a user into performing an action they did not intend to do...

PT-2026-73105

Name of the Vulnerable Software and Affected Versions ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization versions prior to 3.11.6 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated...

PT-2026-73113

Name of the Vulnerable Software and Affected Versions Solace Extra versions prior to 1.6.1 Description The Solace Extra plugin for WordPress contains a flaw allowing unauthorized modification and loss of data. The issue stems from a missing capability check in the import zip function. The handler...

PT-2026-73080

Name of the Vulnerable Software and Affected Versions Quiz and Survey Master QSM – Easy Quiz and Survey Maker versions prior to 11.2.2 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access a...

PT-2026-73088

Name of the Vulnerable Software and Affected Versions Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution versions prior to 5.4.13 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows...

PT-2026-73108

Name of the Vulnerable Software and Affected Versions Youtube Showcase versions prior to 4.0.5 Description Stored Cross-Site Scripting occurs via the emd mb meta shortcode due to insufficient input sanitization and output escaping on attachment titles. The function EMD MB Helper::image info retur...

PT-2026-73082

Name of the Vulnerable Software and Affected Versions Bookly versions prior to 27.8 Description An Insecure Direct Object Reference exists in the Mobile Staff Cabinet API via the appointment function. The issue occurs because the handler loads an appointment using the paramsid variable without...

PT-2026-73085

Name of the Vulnerable Software and Affected Versions Query Wrangler versions prior to 1.5.58 Description Authenticated attackers with subscriber-level access and above can achieve Remote Code Execution on the server. The issue exists in the wp ajax qw form ajax handler due to a lack of capabilit...

CVE-2026-19726: Incorrect Authorization

The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own...