PT-2026-88856

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a...

PT-2026-88855

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking...

PT-2026-88869

The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enrolment record over its REST API, allowing unauthenticated users to read any learner's enrolment status, timestamps and course-progress data by walking sequential record identifier...

PT-2026-88877

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9 does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markup, allowing users with contributor-level access an...

PT-2026-88876

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent...

PT-2026-88871

Name of the Vulnerable Software and Affected Versions Quentn WP versions prior to 1.2.15 Description Unauthenticated attackers can extract arbitrary data from the database through SQL injection. This occurs because the plugin fails to adequately escape request parameters before incorporating them...

PT-2026-88885

The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute in all versions up to, and including, 3.2.4 due to insufficient input sanitization and output...

PT-2026-88879

The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any...

PT-2026-88880

The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...

PT-2026-88881

The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...

PT-2026-88897

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpl user preference' parameter in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-88791

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to, and including, 1.31.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

PT-2026-89057

Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wp handle upload that disables WordPress core's file type...

PT-2026-89266

Name of the Vulnerable Software and Affected Versions WP BackItUp Community Edition versions prior to 2.1.1 Description An issue exists where authenticated attackers with administrator-level access and above can perform Directory Traversal, a technique used to access files and directories that ar...

PT-2026-89267

Name of the Vulnerable Software and Affected Versions Advanced Contact form 7 DB versions prior to 2.1.4 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows authenticated attackers with custom-leve...

PT-2026-89268

Name of the Vulnerable Software and Affected Versions Easy Google Fonts versions prior to 2.0.5 Description Stored Cross-Site Scripting occurs because the plugin registers the control selectors meta field with show in rest enabled but lacks a sanitize callback. Consequently, unsanitized data is...

PT-2026-89261

Name of the Vulnerable Software and Affected Versions Bulk Password Reset versions prior to 1.3.4 Description This issue allows authenticated attackers with subscriber-level access and above to perform privilege escalation via account takeover. The flaw exists because the plugin fails to properly...

PT-2026-89265

Name of the Vulnerable Software and Affected Versions Builderall Cheetah For Wp versions prior to 3.0.3 Description Unauthorized modification of data is possible due to a missing capability check in the disable function. The wp ajax ba cheetah disable AJAX handler is registered without capability...

PT-2026-88858

The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records including email addresses and roles and arbitrary site options...

PT-2026-88798

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attribute in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...