PT-2026-56326

The Eventer plugin for WordPress is vulnerable to time-based SQL Injection via the ‘code’ parameter in all versions up to, and including, 4.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

PT-2026-56313

The Simple Coherent Form plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the removeUploadDir function in all versions up to, and including, 2.4.13. This makes it possible for unauthenticated attackers to delete arbitrary files on the serve...

PT-2026-56314

Name of the Vulnerable Software and Affected Versions Eventer versions prior to 4.4.3 Description The plugin implements an insecure password reset mechanism. When a password reset is requested, a plaintext copy of the reset key is stored in the eventer verification code user meta field within the...

PT-2026-56396

The Themehunk Login Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.0.2. This is due to the handle frontend register function in the unauthenticated /thlogin/v1/register REST endpoint accepting a user-controlled 'role' parameter and...

PT-2026-56315

Name of the Vulnerable Software and Affected Versions Backstage - Customizer Demo Access versions prior to 1.4.3 Description This issue allows unauthenticated attackers to achieve privilege escalation. The plugin assigns the manage options capability to the backstage customizer user demo role,...

PT-2026-56318

Name of the Vulnerable Software and Affected Versions Chatra Live Chat + ChatBot + Cart Saver versions prior to 1.0.13 Description Insufficient input sanitization and output escaping in the admin settings allow authenticated attackers with administrator-level permissions and above to perform Stor...

PT-2026-56407

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'special requests' parameter in all versions up to, and including, 1.8.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

PT-2026-56408

Name of the Vulnerable Software and Affected Versions VikBooking Hotel Booking Engine & PMS versions prior to 1.8.9 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique where malicious scripts are...

PT-2026-56394

Name of the Vulnerable Software and Affected Versions Smash Balloon Social Photo Feed – Easy Social Feeds Plugin versions prior to 6.11.2 Description Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the maybe connection data function. This allows unauthenticated...

PT-2026-56405

The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'commentIcon' parameter in all versions up to, and including, 4.7.4 due to insufficient input sanitization and output escaping. This makes it possible...

PT-2026-56406

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'additional' parameter in all versions up to, and including, 2026.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

PT-2026-56414

Name of the Vulnerable Software and Affected Versions Blocksy Companion Pro plugin for WordPress versions prior to 2.1.47 Description An unauthenticated arbitrary file upload issue exists within the Advanced Reviews feature. The save attachments function fails to properly validate file extensions...

PT-2026-56400

Name of the Vulnerable Software and Affected Versions LatePoint – Calendar Booking Plugin for Appointments and Events versions prior to 5.4.1 Description Improper input validation in the Stripe Connect payment processor allows unauthenticated attackers to pay an arbitrary amount. This occurs...

PT-2026-56404

Name of the Vulnerable Software and Affected Versions Essential Addons for Elementor versions prior to 6.6.3 Description Stored Cross-Site Scripting XSS occurs in the Event Calendar widget due to insufficient input sanitization and output escaping on event titles sourced from The Events Calendar...

PT-2026-56317

The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'heateor mastodon share' parameter in all versions up to, and including, 7.14.5 due to insufficient input sanitization and output escaping. Thi...

PT-2026-56310

Name of the Vulnerable Software and Affected Versions Widget Logic Visual versions prior to 1.53 Description Authenticated attackers with subscriber-level access and above can achieve remote code execution on the server. The issue occurs during the widget-logic-update-conditional-tags AJAX action...

WordPress Bulk Order Update for WooCommerce plugin <= 1.6 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by nthng in WordPress Plugin Bulk Order Update for WooCommerce versions = 1.6...

WordPress FormyChat plugin <= 2.15.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dodoh4t in WordPress Plugin FormyChat versions = 2.15.3...

WordPress ElementInvader Addons for Elementor plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Evan NR in WordPress Plugin ElementInvader Addons for Elementor versions = 1.4.3...

CVE-2026-6101

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Arbitrary File Write in versions up to and including 1.1.12. This is due to unsafe ZIP file extraction in the ampforwpsavelocalfont function combined with inadequate cleanup that fails to remove nested directories and...