PT-2026-81273

Name of the Vulnerable Software and Affected Versions Media Sweep – WordPress Media Cleaner versions prior to 1.1.4 Description An issue exists where authenticated attackers with administrator-level access and above can perform a generic SQL Injection. This occurs due to insufficient escaping of...

VulnCheck KEV: CVE-2026-16747

The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode execution, allowing unauthenticated users to run any shortcode registered on the site, which on a default install leads to disclosur...

12 Step Meeting List < 3.19.17 - Unauthenticated Stored Cross-Site Scripting

Description The 12 Step Meeting List plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.19.16. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

PT-2026-80832

Subscriber SQL Injection in ProLancer Element = 1.4.8 versions...

PT-2026-81050

Name of the Vulnerable Software and Affected Versions MagicAI for WordPress versions 1.4 and earlier Description A Local File Inclusion issue exists that allows users with Subscriber privileges to read arbitrary files on the server. Recommendations Update MagicAI for WordPress to a version later...

PT-2026-80825

Name of the Vulnerable Software and Affected Versions Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More versions prior to 1.7.2 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions...

PT-2026-81266

Name of the Vulnerable Software and Affected Versions My Agile Privacy® – CMP, Cookie Consent & Privacy Tools versions prior to 3.3.7 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows...

PT-2026-81917

CVE-2026-16249 - Rejected reason: This CVE ID is a duplicate of CVE CVE ID :CVE-2026-16249 Published : Aug. 24, 2026, 10:16 a.m. | 35 minutes ago Description :Rejected reason: This CVE ID is a duplicate of CVE-2026-15303 and was never published. Both IDs were assigned to the same vulnerability in...

PT-2026-81248

Name of the Vulnerable Software and Affected Versions eCommerce Product Catalog versions prior to 3.5.11 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary...

PT-2026-81267

Name of the Vulnerable Software and Affected Versions The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin versions prior to 2.12.2 Description Stored Cross-Site Scripting occurs via the Textarea Profile Field with HTML Support due to...

PT-2026-81054

Unauthenticated Broken Authentication in WPLegalPages = 3.7.0 versions...

PT-2026-81165

Name of the Vulnerable Software and Affected Versions Events Manager – Calendar, Bookings, Tickets, and more! versions prior to 7.4.0.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting XSS. This occurs when t...

CVE-2026-77003

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...

CVE-2026-13598

The RestrictMate WordPress plugin before 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to create a new administrator account and gain a logged-in administrator session, leading to full site takeover...

EUVD-2026-64639

Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...

CVE-2026-77003 Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capability Bypass via create_new_content_mask

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...

EUVD-2026-64637

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...

CVE-2026-77003 Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capability Bypass via create_new_content_mask

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...

WordPress Brave plugin < 0.8.6 - Subscriber+ Unpublished Popup Disclosure vulnerability

Subscriber+ Unpublished Popup Disclosure vulnerability discovered by Huseyin Mertoglu in WordPress Plugin Brave versions 0.8.6...

CVE-2026-77003

The Content Mask WordPress plugin (versions 1.8.0 through 1.8.5.4 ) is vulnerable to a Contributor Publish Capability Bypass . The flaw occurs because the plugin fails to verify the necessary capabilities required to publish specific post types during creation. This allows users with low-level ro...