CVE-2026-84734: Improper Authentication

The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress...

PT-2026-110029

Name of the Vulnerable Software and Affected Versions click5 CRM add-on to Gravity Forms versions prior to 1.0.4 Description The plugin lacks authorization and Cross-Site Request Forgery CSRF checks when updating options through a REST endpoint. Additionally, it fails to verify if the option bein...

CVE-2026-96227: Improper Neutralization of Input During Web Page Generation

The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is...

CVE-2026-81797

Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme = 1.0.2 versions...

CVE-2026-62035

Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted = 3.1.0 versions...

CVE-2026-57742 WordPress Kids Planet theme <= 2.2.14.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2...

CVE-2026-107434

The WordPress MicroPayments plugin versions

CVE-2026-107434 WordPress MicroPayments plugin <= 3.2.9 - Bypass Vulnerability vulnerability

Subscriber Bypass Vulnerability in MicroPayments = 3.2.9 versions...

CVE-2026-81797 WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme = 1.0.2 versions...

EUVD-2026-96531

Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme = 1.0.2 versions...

CVE-2026-81797

The Buzz Stone | Magazine & Viral Blog WordPress Theme (versions

CVE-2026-78535

The Photolia WordPress theme (versions

CVE-2026-78534 WordPress Educavo theme <= 3.4.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Educavo = 3.4.2 versions...

CVE-2026-78534

The Educavo WordPress theme versions

CVE-2026-78532 WordPress LMS theme <= 8.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in LMS = 8.3 versions...

CVE-2026-78532

The WordPress LMS theme (versions

CVE-2026-78529 WordPress Alliance theme <= 3.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Alliance = 3.11 versions...

CVE-2026-66568

The WordPress Original theme (versions

CVE-2026-66565 WordPress FC United theme <= 1.1.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in FC United = 1.1.1 versions...

CVE-2026-66481 WordPress Presto Player Pro plugin <= 3.0.1 - Arbitrary File Deletion vulnerability

Author Arbitrary File Deletion in Presto Player Pro = 3.0.1 versions...