100239 matches found
PT-2026-72155
Name of the Vulnerable Software and Affected Versions Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms versions prior to 5.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique...
PT-2026-73045
Name of the Vulnerable Software and Affected Versions Link Library versions prior to 7.9.5 Description Insufficient file path validation in the ll delete link fields function allows unauthenticated attackers to delete arbitrary files on the server. This can lead to remote code execution if critic...
PT-2026-72157
Name of the Vulnerable Software and Affected Versions The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress versions prior to 30.0.8 Description An issue exists where authenticated attackers with author-level access and above can perform a Second-Order...
PT-2026-72887
Name of the Vulnerable Software and Affected Versions WPML Multilingual CMS versions prior to 4.9.6 Description Insufficient escaping of user-supplied input and lack of proper preparation in SQL queries allow authenticated attackers with translator-level access or higher to perform SQL Injection...
PT-2026-72152
Name of the Vulnerable Software and Affected Versions Hydra Booking — Appointment Scheduling & Booking Calendar versions prior to 1.2.3 Description Stored Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping. This allows attackers to inject arbitrary web...
PT-2026-72879
Name of the Vulnerable Software and Affected Versions Real Estate Manager Pro versions prior to 12.8.7 Description Improper capability handling in the allow attachment actions function allows authenticated attackers with Subscriber-level access or higher to escalate their privileges to...
CVE-2026-14230: Improper Neutralization of Input During Web Page Generation
The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers gated only by a capability-agnostic nonce that any editposts user obtains from the Elementor editor, so a Contributor can write a data-source binding into any post —...
PT-2026-72144
Name of the Vulnerable Software and Affected Versions 6Storage Rentals versions prior to 2.27.1 Description An authentication bypass exists that allows unauthenticated attackers to log in as any existing WordPress user, including administrators. The issue occurs because the six storage create wp...
PT-2026-72148
Name of the Vulnerable Software and Affected Versions Image Uploader for Welcart versions prior to 1.4.7 Description The Image Uploader for Welcart plugin for WordPress contains a SQL Injection flaw. This occurs because the plugin does not sufficiently escape the post title parameter and fails to...
PT-2026-72158
Name of the Vulnerable Software and Affected Versions Beaver Builder Page Builder versions prior to 2.10.2.3 Description The Beaver Builder Page Builder plugin for WordPress contains a stored cross-site scripting issue. This occurs due to insufficient input sanitization and output escaping within...
PT-2026-72161
Name of the Vulnerable Software and Affected Versions ECS WordPress plugin versions prior to 4.3.8 Description An issue exists where the plugin fails to verify post status or user capabilities when rendering an Elementor document via AJAX actions. This allows unauthenticated users to retrieve the...
40,000 WordPress Sites affected by Authentication Bypass Vulnerability in User Profile Builder WordPress Plugin
On July 14th, 2026, we received a submission for an Authentication Bypass vulnerability in User Profile Builder, a WordPress plugin with more than 40,000 active installations. This vulnerability makes it possible for unauthenticated attackers to log in as the user with ID 1, which is typically th...
WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Steven Julian in WordPress Plugin Essential Real Estate versions = 5.3.3...
WordPress Theme Test Drive plugin <= 2.9.1 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by Steven Julian in WordPress Plugin Theme Test Drive versions = 2.9.1...
WordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Vavo Core versions = 2.3.0...
WordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by hhhai in WordPress Plugin WP Sort Order versions = 1.3.5...
WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability
Broken Authentication vulnerability discovered by DmTomHe in WordPress Plugin User Registration versions = 5.2.6...
WordPress Site Reviews plugin <= 8.2.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Jorgson in WordPress Plugin Site Reviews versions = 8.2.0...