PT-2026-71388

The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the get advance file by url method in all versions up to, and including, 2.8.8.8 The method uses a SQL LIKE operator for token...

PT-2026-71523

Name of the Vulnerable Software and Affected Versions WP Event SOlution versions prior to 4.1.19 Description The Event SOlution plugin for WordPress allows authenticated attackers with customer-level access or higher to extract sensitive user or configuration data. Recommendations Update to a...

PT-2026-71506

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

PT-2026-71559

Unauthenticated Local File Inclusion in Geo Mashup = 1.13.18 versions...

PT-2026-71518

Name of the Vulnerable Software and Affected Versions Service Finder Booking versions prior to 6.3 Description The Service Finder Booking plugin for WordPress contains a broken access control issue. A missing capability check in a function allows authenticated users with subscriber-level...

PT-2026-71606

Unauthenticated Broken Access Control in User Registration = 5.2.6 versions...

PT-2026-71590

Subscriber Broken Access Control in Motors = 1.4.113 versions...

PT-2026-71604

Donor Cross Site Scripting XSS in GiveWP 4.16.6 versions...

PT-2026-71521

Name of the Vulnerable Software and Affected Versions Blog Floating Button versions prior to 1.4.21 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which...

PT-2026-71592

Unauthenticated Cross Site Scripting XSS in SureDash = 1.10.1 versions...

PT-2026-71584

Subscriber SQL Injection in Reviewer = 3.14.2 versions...

PT-2026-71530

Name of the Vulnerable Software and Affected Versions Travelfic Toolkit versions prior to 1.5.2 Description The Travelfic Toolkit plugin for WordPress contains a broken access control issue. A missing capability check in a function allows authenticated users with subscriber-level permissions or...

CVE-2026-49466

Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting XSS in the drafts shortcode and Draft List widget when the documented custom template option places the draft placeholder inside an HTML attribute. Th...

CVE-2026-49466 Draft List - Contributor Stored Cross-Site Scripting via Draft Title in Custom Drafts Template Attributes

Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting XSS in the drafts shortcode and Draft List widget when the documented custom template option places the draft placeholder inside an HTML attribute. Th...

EUVD-2026-57514

Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting XSS in the drafts shortcode and Draft List widget when the documented custom template option places the draft placeholder inside an HTML attribute. Th...

CVE-2026-49466

Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting XSS in the drafts shortcode and Draft List widget when the documented custom template option places the draft placeholder inside an HTML attribute. Th...

CVE-2026-49466 Draft List - Contributor Stored Cross-Site Scripting via Draft Title in Custom Drafts Template Attributes

Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting XSS in the drafts shortcode and Draft List widget when the documented custom template option places the draft placeholder inside an HTML attribute. Th...

WordPress GiveWP plugin < 4.16.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Asim Alshaya in WordPress Plugin GiveWP versions 4.16.6...

CVE-2026-17008

The Quick Paypal Payments WordPress plugin through 5.7.50 does not verify the paid amount, receiver, or payment status in its PayPal IPN handler and marks an order paid on an order-token match alone, so a buyer who pays an arbitrary small amount can have a full-price order marked paid...

CVE-2026-18044

The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on...