CVE-2026-107120 Contest Gallery < 33.0.1 - Unauthenticated Email Verification Bypass via Brute-Forceable Registration PIN

The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to ...

CVE-2026-107323 Gallery PhotoBlocks 1.3.5 - Contributor+ Stored XSS

The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of anyone who views a page containing...

CVE-2026-107120 Contest Gallery < 33.0.1 - Unauthenticated Email Verification Bypass via Brute-Forceable Registration PIN

The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to ...

CVE-2026-105977

The Portfolio Filter Gallery WordPress plugin versions before 2.2.1 is vulnerable to an authorization bypass due to a lack of per-object authorization checks. Specifically, the pfg_delete_video_thumbnail function fails to verify ownership, allowing users with the Contributor role and above to per...

CVE-2026-105977 Portfolio Filter Gallery 2.0.2 - 2.2.0 - Contributor+ Cross-User Video Thumbnail Deletion via pfg_delete_video_thumbnail

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor role and above to permanently delete certain media attachments belonging to other users, including administrators...

CVE-2026-104752 Rank Math SEO < 1.0.280 - Admin+ Arbitrary File Upload to RCE via Settings Import

The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution...

WordPress Rank Math SEO plugin < 1.0.280 - Admin+ SQLi vulnerability

Admin+ SQLi vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Rank Math SEO versions 1.0.280...

CVE-2026-104754

The Rank Math SEO WordPress plugin (versions before 1.0.280 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to a failure to escape a stored redirection source value. An attacker with permissions to manage redirections (typically Administrators ) can inject malicious JavaScript that execu...

CVE-2026-104752

The Rank Math SEO WordPress plugin, in versions prior to 1.0.280 , is vulnerable to remote code execution (RCE) . The root cause is an unrestricted upload of file with dangerous type (CWE-434) within the settings import feature, which fails to correctly validate the type of uploaded files. This a...

CVE-2026-104754 Rank Math SEO < 1.0.280 - Admin+ Stored XSS via Redirection Source URL

The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting it in an administrative list view, allowing users who can manage redirections Administrators by default to store JavaScript that executes in the session of any user who later open...

CVE-2026-104753 Rank Math SEO < 1.0.280 - Admin+ SQLi via 'per_page' Parameter

The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing high-privilege users such as administrators to perform SQL injection attacks...

PT-2026-109802

Name of the Vulnerable Software and Affected Versions AWS S3 for WordPress Plugin versions prior to 3.1.1 Description Broken access control allows users with subscriber privileges to perform unauthorized actions within the plugin. Recommendations Update to a version newer than 3.1.0...

PT-2026-109540

The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number that was actually verified during its OTP password reset, allowing unauthenticated attackers to set a new password on an arbitrary account, including an administrator, by...

PT-2026-109534

The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

PT-2026-109517

The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to ...

PT-2026-109539

The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to, allowing unauthenticated attackers to sign in as any user with a stored phone number, including an administrator, by completing a code challenge on a phon...

CVE-2026-105995: Exposure of Sensitive Information to an Unauthorized Actor

The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens...

CVE-2026-94257: Improper Privilege Management

The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number that was actually verified during its OTP password reset, allowing unauthenticated attackers to set a new password on an arbitrary account, including an administrator, by...

CVE-2026-94256: Improper Authentication

The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to, allowing unauthenticated attackers to sign in as any user with a stored phone number, including an administrator, by completing a code challenge on a phon...

CVE-2026-85571: Authorization Bypass Through User-Controlled Key

The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course the requester manages, allowing users with instructor level access to reassign the parent of any post on the site, taking other instructors' course content...