PT-2026-89748

Name of the Vulnerable Software and Affected Versions Sticky Chat Widget versions prior to 1.4.3 Description Unauthenticated attackers can perform SQL Injection through the scw form fields parameter array keys within the scw save form data AJAX action. The issue occurs because the save form data...

WordPress Aruba HiSpeed Cache plugin <= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin Aruba HiSpeed Cache versions = 3.0.14...

Exploit for SQL Injection in Wpfastestcache Wp_Fastest_Cache

CVE-2023-6063 — WP Fastest Cache SQL Injection PoC !Python...

WordPress Easy Google Fonts plugin <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Kitch in WordPress Plugin Easy Google Fonts versions = 2.0.4...

WordPress Advanced Contact form 7 DB plugin <= 2.1.3 - Missing Authorization to Authenticated (Custom+) Unauthorized Data Import vulnerability

Missing Authorization to Authenticated Custom+ Unauthorized Data Import vulnerability discovered by Jiang CY in WordPress Plugin Advanced Contact form 7 DB versions = 2.1.3...

WordPress WP BackItUp Community Edition plugin <= 2.1.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read vulnerability

Authenticated Administrator+ Path Traversal to Arbitrary File Read vulnerability discovered by Nikola Kojic in WordPress Plugin WP BackItUp versions = 2.1.0...

CVE-2026-82530

IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to circumvent IP-based restrictions by forging the X-Real-IP HTTP header. Attackers can set the X-Real-IP header to an allowlisted IP address...

CVE-2026-26212

Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wphandleupload that disables WordPress core's file type validati...

EUVD-2026-75028

Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wphandleupload that disables WordPress core's file type validati...

CVE-2026-26212 Rara One Click Demo Import < 1.3.5 Arbitrary File Upload RCE

Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wphandleupload that disables WordPress core's file type validati...

CVE-2026-26212

The Rara One Click Demo Import WordPress plugin before version 1.3.5 contains an arbitrary file upload vulnerability. Authenticated attackers with Administrator privileges can pass a false value to wp_handle_upload() , disabling WordPress core's file type validation across all three file paramete...

WordPress Builderall for WordPress plugin <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Post Meta Modification vulnerability discovered by Wordfence PRISM in WordPress Plugin Builderall Builder for WordPress versions = 3.0.2...

WordPress Builderall for WordPress plugin <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Builderall Builder for WordPress versions = 3.0.2...

WordPress Builderall for WordPress plugin <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Builderall Builder for WordPress versions = 3.0.2...

EUVD-2026-75018

IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to circumvent IP-based restrictions by forging the X-Real-IP HTTP header. Attackers can set the X-Real-IP header to an allowlisted IP address...

CVE-2026-82530 IP2Location Country Blocker < 2.45.0 Access Control Bypass via X-Real-IP Header

IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to circumvent IP-based restrictions by forging the X-Real-IP HTTP header. Attackers can set the X-Real-IP header to an allowlisted IP address...

CVE-2026-82530 IP2Location Country Blocker < 2.45.0 Access Control Bypass via X-Real-IP Header

IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to circumvent IP-based restrictions by forging the X-Real-IP HTTP header. Attackers can set the X-Real-IP header to an allowlisted IP address...

WordPress Brevo – Email, SMS, Web Push, Chat, and more. plugin <= 3.1.77 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by stealthcopter in WordPress Plugin Brevo versions = 3.1.77...

WordPress TelSender – Сontact form 7, Events, Wpforms, ninja forms and woocommerce to telegram bot plugin <= 1.14.14 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Kai Aizen in WordPress Plugin TelSender versions = 1.14.14...

WordPress Podlove Podcast Publisher plugin <= 4.5.1 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by an unknown individual in WordPress Plugin Podlove Podcast Publisher versions = 4.5.1...