EUVD-2026-50966

The FleekDash V2 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-14356

The FleekDash V2 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-16092

The Improved Save Button plugin for WordPress is vulnerable to second-order SQL Injection via 'metakey' Custom Field via 'Save and Duplicate' Action in all versions up to, and including, 1.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-16092

The CVE-2026-16092 entry concerns The Improved Save Button plugin for WordPress. A second-order SQL injection affects all versions up to 1.2.1 via the ‘meta_key’ Custom Field when using the ‘Save and Duplicate’ action. Root cause: insufficient escaping of user-supplied parameters and inadequate p...

EUVD-2026-50952

The Persian Elementor المنتور فارسی plugin for WordPress is vulnerable to Price Manipulation in all versions up to, and including, 2.8.1. This is due to the plugin trusting a user-supplied payment amount without server-side validation against the configured ZarinPal widget price. This makes it...

EUVD-2026-50951

The Improved Save Button plugin for WordPress is vulnerable to second-order SQL Injection via 'metakey' Custom Field via 'Save and Duplicate' Action in all versions up to, and including, 1.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-16092 Improved Save Button <= 1.2.1 - Authenticated (Author+) Second-Order SQL Injection via 'meta_key' Parameter

The Improved Save Button plugin for WordPress is vulnerable to second-order SQL Injection via 'metakey' Custom Field via 'Save and Duplicate' Action in all versions up to, and including, 1.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-1982

The Persian Elementor المنتور فارسی plugin for WordPress is vulnerable to Price Manipulation in all versions up to, and including, 2.8.1. This is due to the plugin trusting a user-supplied payment amount without server-side validation against the configured ZarinPal widget price. This makes it...

CVE-2026-1982 Persian Elementor (المنتور فارسی) <= 2.8.1 - Unauthenticated Price Manipulation via ZarinPal Widget

The Persian Elementor المنتور فارسی plugin for WordPress is vulnerable to Price Manipulation in all versions up to, and including, 2.8.1. This is due to the plugin trusting a user-supplied payment amount without server-side validation against the configured ZarinPal widget price. This makes it...

CVE-2026-1982

The Persian Elementor (المنتور فارسی) WordPress plugin is vulnerable up to version 2.8.1 due to trusting a user-supplied payment amount without server-side validation against the ZarinPal widget price. Unauthenticated attackers can submit arbitrary payment amounts to the ZarinPal gateway via the ...

PT-2026-66462

Name of the Vulnerable Software and Affected Versions FuseWP versions prior to 1.1.24.3 Description The FuseWP plugin for WordPress contains a Cross-Site Request Forgery CSRF flaw, which occurs when a web application fails to verify that a request was intentionally initiated by the user. This iss...

PT-2026-66381

The Easy Appointments WordPress plugin through 3.12.26 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...

PT-2026-66393

The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks...

WordPress Subscriptions for WooCommerce plugin <= 2.0.0 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation vulnerability

Missing Authorization to Authenticated Shop Manager+ Arbitrary Plugin Installation vulnerability discovered by Wordfence PRISM in WordPress Plugin Subscriptions for WooCommerce versions = 2.0.0...

NPM: mathlive's Lack of Escaping of HTML allows for XSS

NPM: mathlive's Lack of Escaping of HTML allows for XSS vulnerability discovered by ? in WordPress Npm mathlive versions = 0.109.2...

WP2Shell WordPress Exploit Technical Analysis and Real Attack Data

On July 17th, 2026, the WordPress Security Team released updates to WordPress core addressing a critical vulnerability chain that can be leveraged by unauthenticated attackers to create an administrator account and then execute code through normal administrator capabilities, such as uploading a...

WordPress Improved Save Button plugin <= 1.2.1 - Authenticated (Author+) Second-Order SQL Injection vulnerability

Authenticated Author+ Second-Order SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Improved Save Button versions = 1.2.1...

NPM: swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies

NPM: swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies vulnerability discovered by ? in WordPress Npm swagger-typescript-api versions = 13.12.1...

NPM: swagger-typescript-api vulnerable to code injection via unescaped enum string values

NPM: swagger-typescript-api vulnerable to code injection via unescaped enum string values vulnerability discovered by ? in WordPress Npm swagger-typescript-api versions = 13.12.1...

NPM: swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`

NPM: swagger-typescript-api vulnerable to Server-Side Request Forgery via spec $ref vulnerability discovered by ? in WordPress Npm swagger-typescript-api versions = 13.12.1...