PT-2026-97714

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description The plugin fails to verify if user registration is enabled on the site before processing account creation through its front-end registration flows. This allows unauthenticat...

CVE-2026-88846: Missing Authorization

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not check whether user registration is enabled on the site before creating an account through one of its front-end registration flows, allowing unauthenticated users to create accounts, and be logged into them, on sites wher...

WordPress YOP Poll plugin <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover vulnerability

Unauthenticated Origin Validation Error to Administrator Account Takeover vulnerability discovered by Supakiad S. m3ez in WordPress Plugin YOP Poll versions = 7.0.10...

WordPress Category Discount Woocommerce plugin <= 5.18 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Category Discount Woocommerce versions = 5.18...

WordPress W4 Post List plugin <= 3.0.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin W4 Post List versions = 3.0.6...

WordPress Safe SVG plugin <= 2.5.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Safe SVG versions = 2.5.0...

WordPress Team plugin <= 6.0.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by saddanr in WordPress Plugin Team versions = 6.0.0...

WordPress Ultimate FAQ plugin <= 2.4.14 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Ultimate FAQ versions = 2.4.14...

WordPress Razorpay Payment Button plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Razorpay Payment Button versions = 2.4.9...

WordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin WP Photo Album Plus versions = 9.3.02.002...

CVE-2026-90950 Paid Member Subscriptions < 3.1.0 - Unauthenticated reCAPTCHA Bypass via Registration Form

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, allowing unauthenticated users to create accounts without solving the reCAPTCHA the site has enabled...

CVE-2026-87848 MPCX Lightbox 1.2.2 - 1.2.5 - Unauthenticated Non-Public Post Content Disclosure

The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does it check the status of the requested post, allowing unauthenticated visitors to retrieve the title, content or excerpt o...

CVE-2026-87848

The MPCX Lightbox WordPress plugin (versions 1.2.2 through 1.2.5 ) is vulnerable to unauthenticated non-public post content disclosure. The root cause is a lack of authorisation or authentication on one of its AJAX actions , combined with a failure to check the status of the requested post. Conse...

CVE-2026-87071

The Forminator Forms WordPress plugin versions before 1.57.2.1 is vulnerable to Unauthenticated Post Meta Injection . The root cause is the plugin's failure to restrict metadata keys provided during form submissions or to exclude keys reserved by WordPress. Consequently, unauthenticated visitors ...

CVE-2026-86601 WP Recipe Maker < 10.8.2 - Unauthenticated Arbitrary Shortcode Execution via Comment Content

The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes...

WordPress Fluent Support plugin <= 2.3.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Brobicho in WordPress Plugin Fluent Support versions = 2.3.2...

CVE-2026-91025

The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or...

CVE-2026-90951

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state...

CVE-2026-91073

The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allowing authenticated users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who views a...

CVE-2026-81338

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding...