CVE-2026-81338 MasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding...

CVE-2026-81338 MasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding...

EUVD-2026-85024

The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers to write arbitrary PHP files on the server and achieve RCE when the relevant feature is enabled...

WordPress zportals plugin < 6.4.2 - Subscriber+ User Email Disclosure vulnerability

Subscriber+ User Email Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin Zportals versions 6.4.2...

CVE-2026-14321 Divi Dash < 1.0.7 - Unauthenticated Denial of Service via IP Address Spoofing

The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored...

EUVD-2026-85022

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings...

EUVD-2026-85023

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on one of its AJAX actions, allowing users with a subscriber-level account to disclose the display name and email address of every registered user, including administrators...

CVE-2026-14321

The divi-dash WordPress plugin, versions prior to 1.0.7 , is vulnerable to an unauthenticated Denial of Service due to insufficient validation of client IP addresses used for rate limiting and banning. An attacker can spoof arbitrary IP addresses to bypass these security measures, ban legitimate ...

WordPress Real3D Flipbook plugin < 5.4 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Hanif Naufal Rahman in WordPress Plugin Real 3D FlipBook versions 5.4...

PT-2026-97165

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description An issue exists where the plugin fails to perform a per-object ownership check when returning quiz attempt results. This allows any authenticated user with a subscriber role...

CVE-2026-84098: Incorrect Authorization

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary listings, including ones belonging...

PT-2026-97176

Name of the Vulnerable Software and Affected Versions The Events Calendar WordPress plugin versions prior to 6.17.5 Description The software fails to perform a per-object capability check on a family of its REST write routes. This allows users with low-privilege roles, such as contributors, to...

PT-2026-97173

The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to reach the standard login page through certain password-reset request parameters and to recover the site's configured secret login slug from the returned page...

PT-2026-97272

The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it uses that value both to enforce its per-visitor voting limit and to record who submitted an entry...

PT-2026-97200

Name of the Vulnerable Software and Affected Versions Premium Packages WordPress plugin versions prior to 7.2.1 Description The plugin fails to verify the signature of webhooks received from PayPal when processing payment and subscription notifications. This allows unauthenticated attackers to...

PT-2026-97162

Name of the Vulnerable Software and Affected Versions The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions prior to 8.9.5 Description A REST collection endpoint is not scoped to the requesting user, which allows users with subscriber-level accounts t...

PT-2026-97194

The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or...

CVE-2026-86603: Exposure of Sensitive Information to an Unauthorized Actor

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to retrieve the IDs and titles of other users' unpublished lists...

PT-2026-97197

Name of the Vulnerable Software and Affected Versions WC Fields Factory WordPress plugin versions prior to 4.1.11 Description Insufficient access restrictions and missing nonce verification for a post-cloning action allow users with Contributor-level permissions or higher to duplicate arbitrary...

CVE-2026-81339: Authorization Bypass Through User-Controlled Key

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform a per-object ownership check when returning a quiz attempt result, allowing any authenticated user with a minimal subscriber role to read other students' quiz grades, pass/fail status and attempt timestamps by...