WordPress GeoDirectory plugin <= 2.8.177 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin GeoDirectory versions = 2.8.177...

WordPress Frontend Admin by DynamiApps plugin <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter vulnerability

Unauthenticated Privilege Escalation via 'itemid' Parameter vulnerability discovered by 밥김국 - DDADDA in WordPress Plugin Frontend Admin by DynamiApps versions = 3.29.9...

CVE-2026-15748

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handlefileupload function. This is due to insufficient file type validation in handlefileupload, where the dangerous-extension blocklist performs exact-key matchin...

CVE-2026-15748

Wordfence analysis confirms an unauthenticated attacker can chain a forged Select-field record with the regex-compatible ph(p)|text/x-php pattern to bypass the forminator_allowed_mime_types() exact-key blocklist, upload executable PHP, and achieve RCE on sites with a custom upload root lacking .h...

EUVD-2026-60569

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handlefileupload function. This is due to insufficient file type validation in handlefileupload, where the dangerous-extension blocklist performs exact-key matchin...

EUVD-2026-60570

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-11801

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to...

EUVD-2026-60568

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to...

PT-2026-77111

Name of the Vulnerable Software and Affected Versions Site Reviews versions prior to 8.2.1 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of other users without requiring prior authentication...

PT-2026-77048

Unauthenticated Broken Access Control in Online Contact Widget = 1.3.0 versions...

PT-2026-77120

Name of the Vulnerable Software and Affected Versions Restaurant Menu by MotoPress versions prior to 2.4.12 Description An unauthenticated Local File Inclusion LFI exists, which allows a remote attacker to read files from the server without requiring user interaction. Local File Inclusion is a...

PT-2026-77076

Name of the Vulnerable Software and Affected Versions Appointment Hour Booking versions prior to 1.5.92 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass access restrictions. Recommendations Update to a version newer than 1.5.91...

PT-2026-77102

Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...

PT-2026-77101

Name of the Vulnerable Software and Affected Versions JetAppointment versions prior to 2.5.3 Description An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its databas...

PT-2026-77122

Name of the Vulnerable Software and Affected Versions Charitable versions prior to 1.8.11.4 Description An unauthenticated broken access control issue exists, allowing network exploitation without requiring user interaction. Recommendations Update to a version newer than 1.8.11.3...

PT-2026-77057

Name of the Vulnerable Software and Affected Versions Ultimate Dashboard versions prior to 3.11.3 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication...

PT-2026-78246

Name of the Vulnerable Software and Affected Versions B2BKing versions prior to 5.2.31 Description A missing authorization issue allows the exploitation of incorrectly configured access control security levels. Recommendations Update B2BKing to version 5.2.31 or later...

PT-2026-77060

Name of the Vulnerable Software and Affected Versions Kirki versions prior to 6.2.4 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user by injecting code into a web page. Recommendations Update to a...

PT-2026-77124

Name of the Vulnerable Software and Affected Versions Masteriyo - LMS versions prior to 2.3.3 Description An unauthenticated arbitrary file upload issue exists, allowing an attacker to upload files to the server without requiring authentication. Recommendations Update Masteriyo - LMS to a version...

PT-2026-77117

Name of the Vulnerable Software and Affected Versions Youzify versions prior to 1.3.8 Description The software contains an unauthenticated deserialization flaw. This issue allows an attacker to process untrusted data without requiring authentication or user interaction, making it exploitable over...