PT-2026-77048

Name of the Vulnerable Software and Affected Versions Online Contact Widget versions prior to 1.3.1 Description The Online Contact Widget plugin for WordPress contains a broken access control flaw. This issue occurs because a function lacks a proper capability check, allowing unauthenticated...

PT-2026-78250

Name of the Vulnerable Software and Affected Versions PPWP: Password Protect Pages, Posts & Full or Partial Content versions prior to 1.9.16 Description An improper capability check in the can access function allows authenticated attackers with Contributor-level access or higher to retrieve a...

PT-2026-78256

Name of the Vulnerable Software and Affected Versions Speed Optimizer versions prior to 7.8.1 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This occurs via image tag...

PT-2026-77122

Name of the Vulnerable Software and Affected Versions Charitable versions prior to 1.8.11.4 Description An unauthenticated broken access control issue exists, allowing network exploitation without requiring user interaction. Recommendations Update to a version newer than 1.8.11.3...

PT-2026-77102

Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...

PT-2026-78267

Name of the Vulnerable Software and Affected Versions Atarim – AI Agency for WordPress versions prior to 5.1.2 Description Insufficient file path validation in the AVCF Abilities Media::register replace-media-file execute callback function allows authenticated attackers with author-level access o...

PT-2026-77052

Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.22 versions...

PT-2026-77057

Name of the Vulnerable Software and Affected Versions Ultimate Dashboard versions prior to 3.11.3 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication...

PT-2026-77101

Name of the Vulnerable Software and Affected Versions JetAppointment versions prior to 2.5.3 Description An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its databas...

PT-2026-77051

Unauthenticated Broken Authentication in Ezoic = 2.22.11 versions...

PT-2026-77123

Subscriber Broken Authentication in User Registration = 5.2.6 versions...

PT-2026-77059

Contributor Arbitrary File Upload in GP Premium = 2.5.5 versions...

PT-2026-77078

Unauthenticated Cross Site Scripting XSS in Convert Pro = 1.0.1 versions...

PT-2026-78246

Name of the Vulnerable Software and Affected Versions B2BKing versions prior to 5.2.31 Description A missing authorization issue allows the exploitation of incorrectly configured access control security levels. Recommendations Update B2BKing to version 5.2.31 or later...

PT-2026-77096

Unauthenticated Cross Site Scripting XSS in Affiliates Manager = 2.9.53 versions...

PT-2026-77124

Name of the Vulnerable Software and Affected Versions Masteriyo - LMS versions prior to 2.3.3 Description An unauthenticated arbitrary file upload issue exists, allowing an attacker to upload files to the server without requiring authentication. Recommendations Update Masteriyo - LMS to a version...

PT-2026-77109

Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...

PT-2026-77125

Name of the Vulnerable Software and Affected Versions Starter Templates by Kadence WP versions prior to 2.3.4 Description An unauthenticated Denial of Service DoS issue exists, allowing a remote attacker to cause the application to become unavailable without requiring authentication...

PT-2026-77104

Unauthenticated Cross Site Scripting XSS in Ultimate Maps by Supsystic 1.5.0 versions...

PT-2026-77073

Name of the Vulnerable Software and Affected Versions WP Tab Widget versions prior to 1.2.12 Description Cross Site Scripting XSS allows an attacker with contributor privileges to execute malicious scripts in the browser of other users. Recommendations Update to a version newer than 1.2.11...