CVE-2026-93775: Improper Neutralization of Input During Web Page Generation

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Auphonic Webhook in all versions up to, and including, 4.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-103998: Improper Neutralization of Input During Web Page Generation

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'inputs array key' parameter in all versions up to, and including, 1.15.48 due to insufficient input sanitization and output escaping. This makes...

CVE-2026-96558: Improper Neutralization of Input During Web Page Generation

The Quiz and Survey Master QSM – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'qsmhiddenquestions' parameter in all versions up to, and including, 11.2.6 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-14877: Improper Neutralization of Input During Web Page Generation

The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id attribute in all versions up to, and including, 1.12.03 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-104993: Improper Neutralization of Input During Web Page Generation

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email Contact Email custom field htmlvarname' parameter in all versions up to, and including, 2.8.188 due to insufficient input sanitization...

CVE-2026-104759: Improper Authentication

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION WPO365 | LOGIN plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in all versions up to, and including, 44.1 This is due to IdTokenServiceDeprecated::processopenidconnecttoken using the incompatible WordPress...

CVE-2026-96278: Improper Neutralization of Input During Web Page Generation

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI Session History in all versions up to, and including, 9.3.03.002 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-103482: Improper Neutralization of Input During Web Page Generation

The Simple Newsletter Plugin – Noptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noptinfields e.g. firstname' parameter in all versions up to, and including, 4.3.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

PT-2026-109477

Name of the Vulnerable Software and Affected Versions Extensions For CF7 versions prior to 3.4.6 Description An arbitrary file upload flaw exists in the extcf7 submit function. The issue stems from missing file extension, MIME type, and size validation within the validation filter of the signatur...

PT-2026-109742

Name of the Vulnerable Software and Affected Versions Martfury - WooCommerce Marketplace WordPress Theme versions prior to 3.3.10 Description The software contains a Reflected Cross-site Scripting XSS flaw, which occurs when an application includes untrusted data in a web page without proper...

CVE-2026-96563: Improper Neutralization of Input During Web Page Generation

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stmfs' parameter in all versions up to, and including, 1.4.124 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

PT-2026-109494

Name of the Vulnerable Software and Affected Versions Download Manager versions prior to 3.3.59 Description Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecti...

CVE-2026-89301: Missing Authorization

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the process function in all versions up to, and including, 4.7.13 This makes it possible for unauthenticated attackers to delete arbitrary safe...

CVE-2026-97630: Improper Neutralization of Input During Web Page Generation

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute in all versions up to, and including, 7.5.54.7212 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-85571: Authorization Bypass Through User-Controlled Key

The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course the requester manages, allowing users with instructor level access to reassign the parent of any post on the site, taking other instructors' course content...

CVE-2026-104742: Missing Authorization

The AI Puffer – Chat. Create. Automate. formerly AI Power plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-83526: Unrestricted Upload of File with Dangerous Type

The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the checkmimetype function. This is due to insufficient file type validation in checkmimetype, which writes attacker-supplied remote file content to the public uploads...

CVE-2026-97348: Improper Limitation of a Pathname to a Restricted Directory

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.74.3 via the getinstancecss function. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary file...

CVE-2026-97396: Improper Neutralization of Input During Web Page Generation

The Email Marketing for WordPress and WooCommerce – Retainful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

CVE-2026-104722: Improper Limitation of a Pathname to a Restricted Directory

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the LSDMenusIXCSV::import function in all versions up to, and including, 6.1.2 This makes it possible for authenticate...