WordPress FluentCRM Pro plugin <= 3.1.12 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin FluentCRM Pro versions = 3.1.12...

WordPress Fluent Support Pro plugin <= 2.3.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Support Pro versions = 2.3.1...

WordPress FluentCRM Pro plugin <= 3.1.12 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin FluentCRM Pro versions = 3.1.12...

WordPress Shared Files plugin <= 1.7.69 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Cem Bas in WordPress Plugin Shared Files versions = 1.7.69...

WordPress Booking and Rental Manager plugin <= 2.7.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Bao - BlueRock in WordPress Plugin Booking and Rental Manager versions = 2.7.5...

WordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by qdtad in WordPress Plugin Woo Essential versions = 4.3.0...

WordPress ShopBuilder Pro – Elementor WooCommerce Builder Addons plugin <= 2.2.0 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Jamaal ahmed in WordPress Plugin ShopBuilder Pro – Elementor WooCommerce Builder Addons versions = 2.2.0...

WordPress Brave Conversion Engine (PRO) plugin <= 0.8.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Brave Conversion Engine PRO versions = 0.8.6...

WordPress ProLancer Element plugin <= 1.4.8 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Jamaal ahmed in WordPress Plugin ProLancer Element versions = 1.4.8...

WordPress ProLancer Element plugin <= 1.4.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Jamaal ahmed in WordPress Plugin ProLancer Element versions = 1.4.8...

WordPress WooCommerce File Approval plugin <= 10.7 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Jamaal ahmed in WordPress Plugin WooCommerce File Approval versions = 10.7...

WordPress Super Forms plugin <= 6.3.315 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by VanTastic in WordPress Plugin Super Forms versions = 6.3.315...

WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin <= 8.9.1 - Privilege Escalation vulnerability

WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin = 8.9.1 - Privilege Escalation vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Affiliate Pro - Affiliate Program for WooCommerce & WordPress versions = 8.9.1...

WordPress Templately plugin < 3.7.1 - Unauthenticated Administrator Templately Cloud Connection Overwrite vulnerability

Unauthenticated Administrator Templately Cloud Connection Overwrite vulnerability discovered by Shivamani Vastrala in WordPress Plugin Templately versions 3.7.1...

WordPress EONSR AEO Agent plugin <= 3.7.9 - Unauthenticated Stored XSS via Scheduled Post Creation vulnerability

Unauthenticated Stored XSS via Scheduled Post Creation vulnerability discovered by Pedro Pinho in WordPress Plugin EONSR AEO Agent versions = 3.7.9...

WordPress Infility Global plugin <= 2.15.34 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Denny Abraham Sinaga dennyabrahamsinaga in WordPress Plugin Infility Global versions = 2.15.34...

WordPress Chat On Desk Order Notifications plugin < 1.0.9 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by moonge in WordPress Plugin Chat On Desk Order Notifications versions 1.0.9...

WordPress SMS Alert plugin < 3.9.8 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Sai Praneeth Koti in WordPress Plugin SMS Alert Order Notifications versions 3.9.8...

PT-2026-81052

Name of the Vulnerable Software and Affected Versions ACPT Pro - Custom Post Types Plugin for WordPress versions 2.0.63 and earlier Description PHP Object Injection occurs when an application deserializes untrusted data, allowing an attacker to manipulate the resulting object and potentially...

PT-2026-81170

Name of the Vulnerable Software and Affected Versions tagDiv Composer versions prior to 5.4.6 Description The plugin contains a Stored Cross-Site Scripting issue within the vc raw html shortcode. The vc raw html::render function fails to properly sanitize input and escape output by base64-decodin...