PT-2026-71013

Name of the Vulnerable Software and Affected Versions PowerPress Podcasting versions prior to 11.17.1 Description Insufficient validation of a Podcast Episode URL setting allows users with Contributor privileges or higher to execute Server-Side Request Forgery SSRF attacks. This issue enables the...

PT-2026-71056

Name of the Vulnerable Software and Affected Versions Estatik Real Estate Plugin versions prior to 4.3.4 Description An issue exists where the plugin fails to validate the recipient list used by the property request form when configured to route to a custom address. This allows unauthenticated...

PT-2026-71026

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured...

PT-2026-71007

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution...

CVE-2026-16066: Improper Neutralization of Input During Web Page Generation

The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page...

CVE-2026-13171: Improper Access Control

The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records...

PT-2026-71001

Name of the Vulnerable Software and Affected Versions KiviCare WordPress plugin versions prior to 4.5.2 Description An issue exists where the software fails to verify if the requesting user owns the records they are attempting to access. This allows authenticated users with patient-level privileg...

WordPress AI Engine Cross-Site Script Vulnerability

WordPress AI Engine is an official WordPress plugin developed by developer JordyMeow. It aims to seamlessly integrate mainstream large language models such as OpenAI, Anthropic, and Google into the WordPress backend, providing core features like chatbots, content generation, AI forms, and...

PT-2026-70998

Name of the Vulnerable Software and Affected Versions Eventin WordPress plugin versions prior to 4.1.20 Description Insufficient access restrictions to stored customer records allow users with contributor-level permissions or higher to read personal data of other customers, including names and...

CVE-2026-18046: Incorrect Authorization

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license key, so the route falls back to an authentication-only gate, allowing any authenticated user such as a...

CVE-2026-16737: Authorization Bypass Through User-Controlled Key

The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored...

PT-2026-71018

The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read the content of posts, pages and custom post types that have been restricted to specific user groups...

PT-2026-71497

Name of the Vulnerable Software and Affected Versions Car Rental Manager versions prior to 1.4.0 Description The Car Rental Manager plugin for WordPress allows authenticated attackers with editor-level access and above to perform PHP Object Injection. This occurs through the deserialization of...

PT-2026-71507

Name of the Vulnerable Software and Affected Versions Booktics versions prior to 1.0.23 Description An SQL Injection flaw exists in the Booktics plugin for WordPress. Authenticated attackers with subscriber-level access or higher can append additional SQL queries to existing ones due to...

CVE-2026-12976: Exposure of Sensitive Information to an Unauthorized Actor

The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in...

CVE-2026-18789: Missing Authorization

The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently...

PT-2026-71051

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce WordPress plugin versions prior to 2.11.33 Description The plugin fails to verify the authenticity of the convenience-store and bank-transfer settlement callback. An unauthenticated request can change an order status from...

CVE-2026-18035: Missing Authorization

The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read the content of posts, pages and custom post types that have been restricted to specific user groups...

PT-2026-71033

The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-15606

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...