PT-2026-83149

Author Remote Code Execution RCE in Rank Math SEO = 1.0.276 versions...

PT-2026-82879

The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'referer' parameter in all versions up to, and including, 2.4.17. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

PT-2026-82887

The Breeze Cache WordPress plugin before 2.5.13 does not sanitise a value taken from the request before using it to build the paths of the files it caches, allowing unauthenticated attackers to create files at arbitrary locations on the server, outside the intended cache directory...

PT-2026-82878

The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's' parameter of the Advanced Search REST endpoint in all versions up to, and including, 4.10.1 due to insufficient input sanitization and output escaping. The REST endpoint at...

PT-2026-82874

The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators...

PT-2026-83147

Subscriber Insecure Direct Object References IDOR in WP Job Portal = 2.5.9 versions...

PT-2026-83150

Contributor Broken Access Control in WpEvently = 5.5.0 versions...

EUVD-2026-67900

WordPress plugin Spiffy Plugin before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field. An authenticated attacker with the lowest privileged role contributor can exploit this to redirect user to malicious site or control the account...

EUVD-2026-67902

WordPress plugin Bit Assist before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged role admin can exploit this to redirect user to malicious site or control the account...

CVE-2026-39071

WordPress plugin Spiffy Plugin before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field. An authenticated attacker with the lowest privileged role contributor can exploit this to redirect user to malicious site or control the account...

CVE-2026-19423: Improper Privilege Management

The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot resolve the set of roles a profile form permits, and screens the value against the site's registered role names rather than against the form's own allow-list, allowing unauthenticated...

PT-2026-82888

The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user making the request, allowing authenticated users with Subscriber-level access and above to cancel any other user's in-progress email...

PT-2026-82866

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a' above fold images parameter in all versions up to, and including, 4.2.10 due to insufficient input sanitization and output...

PT-2026-83122

The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2026-82876

Name of the Vulnerable Software and Affected Versions Ultimate Member WordPress plugin versions prior to 2.13.0 Description An issue exists where the plugin fails to validate role selection when it cannot resolve the set of roles permitted by a profile form. Instead of checking against the form's...

PT-2026-83318

Name of the Vulnerable Software and Affected Versions geotargetingwp versions prior to 3.5.6.2 Description The plugin fails to sanitize or escape several parameters before reflecting them in AJAX responses served with an HTML content type. This allows unauthenticated attackers to perform reflecte...

CVE-2026-19092

The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output...

WordPress Avada (Fusion) Builder plugin <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'size' Shortcode Attribute vulnerability discovered by João Pedro Soares de Alcântara - Kinorth in WordPress Plugin Fusion Builder versions = 3.15.6...

WordPress LiteSpeed Cache plugin <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes vulnerability

Authenticated Author+ Stored Cross-Site Scripting via img Tag Attributes vulnerability discovered by stealthcopter in WordPress Plugin LiteSpeed Cache versions = 7.7...

WordPress Smart Slider 3 plugin <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slider' Block Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'slider' Block Attribute vulnerability discovered by Dmitrii Ignatyev - CleanTalk Inc in WordPress Plugin Smart Slider 3 versions = 3.5.1.38...