CVE-2026-91829: Improper Neutralization of Input During Web Page Generation

The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators...

CVE-2026-106029: Missing Authorization

The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide...

CVE-2026-96227: Improper Neutralization of Input During Web Page Generation

The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is...

CVE-2026-87762: Improper Neutralization of Input During Web Page Generation

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has never been set, allowing unauthenticated users to store...

CVE-2026-87760: Improper Neutralization of Input During Web Page Generation

The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visitors before storing them and outputting them in a script context on an administrative page, allowing unauthenticated attackers to perform Stored Cross-Site...

CVE-2026-86798: Improper Neutralization of Input During Web Page Generation

The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST endpoints, and does not escape the values stored through them before outputting them in a public page, allowing unauthenticated users to inject arbitrary web scripts that will execute in the...

CVE-2026-89213: Improper Neutralization of Special Elements used in an SQL Command

The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

CVE-2026-84737: Improper Authentication

The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated attackers to log in as any user whose email address they know, including administrators...

CVE-2026-14854: Uncontrolled Resource Consumption

The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request...

CVE-2026-89232: Improper Neutralization of Special Elements used in an SQL Command

The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database...

CVE-2026-94235: Missing Authorization

The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to make the site send arbitrary HTML emails to arbitrary recipients from its own mail system, which can be abused to relay...

CVE-2026-84258: Improper Neutralization of Input During Web Page Generation

The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-12980: Improper Neutralization of Input During Web Page Generation

The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the content is viewed...

CVE-2026-84260: Improper Neutralization of Input During Web Page Generation

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

PT-2026-110010

Name of the Vulnerable Software and Affected Versions Mobile builder WordPress plugin versions prior to 1.4.3 Description Unauthenticated users can perform SQL injection attacks because the plugin fails to sanitize and escape a parameter before incorporating it into a SQL statement. SQL injection...

PT-2026-110016

Name of the Vulnerable Software and Affected Versions WeddingCity Lite WordPress plugin versions prior to 1.0.5 Description The plugin fails to perform authorization or validity checks before deleting posts, pages, and media attachments. This allows unauthenticated attackers to permanently delete...

PT-2026-110059

Name of the Vulnerable Software and Affected Versions Datalist it versions prior to 0.0.4 Description The Datalist it WordPress plugin fails to sanitize and escape several request parameters used in the construction of SQL queries. This allows unauthenticated attackers to execute SQL injection...

PT-2026-110064

Name of the Vulnerable Software and Affected Versions paymendo WordPress plugin versions prior to 1.2 Description The plugin fails to properly sanitize and escape the paymendo bank transfer completed payment parameter before incorporating it into a SQL query. This flaw allows unauthenticated user...

PT-2026-110063

Name of the Vulnerable Software and Affected Versions Post Voting System versions prior to 1.1 Description An issue exists where the software fails to properly sanitize and escape the id parameter before incorporating it into a SQL query. This allows unauthenticated users to execute SQL injection...

PT-2026-110065

Name of the Vulnerable Software and Affected Versions paymendo WordPress plugin versions prior to 1.2 Description The plugin fails to properly sanitize and escape the orderBy parameter before incorporating it into a SQL query. This flaw allows authenticated users to execute SQL injection attacks,...