WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Other vulnerability Type vulnerability

Other vulnerability Type vulnerability discovered by Erik Debye in WordPress Plugin Paid Videochat Turnkey Site versions = 7.5.12...

WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Erik Debye in WordPress Plugin Paid Videochat Turnkey Site versions = 7.5.12...

CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records

Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence AI-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine. The activity, which brings together commodity offensive tools like Cobal...

WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Gamic versions = 1.19...

WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Good Homes versions = 1.3.13...

WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Gunslinger versions = 1.11...

WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Legal Stone versions = 1.2.11...

WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Le Truffe versions = 1.1.7...

WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Marcell versions = 1.2.14...

WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Meals & Wheels versions = 1.1.13...

WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Orpheus versions = 1.8...

WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Filmax versions = 1.1.11...

WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Motorix versions = 1.11...

WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Nuts versions = 1.12...

CVE-2026-84166

The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request...

CVE-2026-84167

The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referenci...

CVE-2025-15703

The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability Administrator by default to store a...

CVE-2026-107791

The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site...

CVE-2026-84166 Hotel Booking <= 3.8 - Booking Order Creation, Deletion, and Modification via CSRF

The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request...

CVE-2026-84167 Hotel Booking <= 3.8 - Subscriber+ Booking Order PII Disclosure via IDOR

The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referenci...