EUVD-2025-210740

The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the canaccess function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with...

EUVD-2026-62210

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. This issue affects Media LIbrary Assistant: from n/a through 3.39...

EUVD-2026-62208

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Artiss Draft List simple-draft-list allows Stored XSS. This issue affects Draft List: from n/a through 2.6.4...

CVE-2026-12983: Improper Neutralization of Special Elements used in an SQL Command

The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. The same handler also performs a database table truncation without any authorization check, allowing any unauthenticat...

PT-2026-78332

Name of the Vulnerable Software and Affected Versions Community by PeepSo versions prior to 9.0.5.3 Description An issue exists that allows for SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the...

PT-2026-78348

Unauthenticated SQL Injection in Total Donations = 2.0.5 versions...

PT-2026-78941

Name of the Vulnerable Software and Affected Versions Shuffle versions 1.8 and earlier Description An unauthenticated Local File Inclusion issue exists, allowing an attacker to read arbitrary files from the local file system without requiring authentication. Recommendations Update Shuffle to a...

PT-2026-78533

Name of the Vulnerable Software and Affected Versions Elementor Pro versions prior to 4.2.2 Description An unrestricted file upload flaw exists in the Form widget of Elementor Pro, potentially affecting over 6 million active installations. The issue occurs when a public form contains at least one...

PT-2026-78288

Name of the Vulnerable Software and Affected Versions SmartCrawl SEO checker, analyzer & optimizer WordPress plugin versions prior to 3.16.3 Description Insufficient capability checks on two AJAX actions allow users with the Subscriber role or higher to read titles of private and draft posts by I...

CVE-2026-14826: Authorization Bypass Through User-Controlled Key

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including...

CVE-2026-14287: Improper Neutralization of Input During Web Page Generation

The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing an unauthenticated attacker to store markup that executes as...

PT-2026-78297

Name of the Vulnerable Software and Affected Versions TrueBooker versions prior to 1.2.7 Description Lack of proper authorization checks in several AJAX actions allows unauthenticated users to retrieve personally identifiable information PII of customers who booked appointments. The exposed data...

PT-2026-78337

Name of the Vulnerable Software and Affected Versions TrueBooker versions prior to 1.2.7 Description An issue exists that allows unauthenticated users to perform privilege escalation. Recommendations Update to a version newer than 1.2.6...

PT-2026-78344

Unauthenticated Local File Inclusion in Resido = 1.5 versions...

PT-2026-78335

Unauthenticated Cross Site Scripting XSS in Global Gallery = 11.1.2 versions...

PT-2026-78342

Name of the Vulnerable Software and Affected Versions Outranking Plugin versions prior to 1.1.4 Description Broken access control allows unauthenticated users to access the options of the Outranking Plugin. Recommendations Update to a version newer than 1.1.3...

PT-2026-78287

Name of the Vulnerable Software and Affected Versions Product Shortlist WordPress plugin versions prior to 1.0.5 Description An issue exists where a parameter is not properly sanitized and escaped before being used in a SQL statement. This allows unauthenticated attackers to execute SQL injection...

PT-2026-78347

Name of the Vulnerable Software and Affected Versions Total Donations versions prior to 2.0.6 Description An issue allows unauthenticated users to perform privilege escalation. Recommendations Update to a version newer than 2.0.5...

PT-2026-79297

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce versions prior to 2.12.1 Description This issue occurs because the software fails to regenerate the session identifier during authentication and accepts a session identifier provided via a user-supplied request parameter. Th...

CVE-2026-18231: Exposure of Sensitive Information to an Unauthorized Actor

The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve the usernames and email addresses of users holding the WP Directory Kit WordPress plug...