PT-2026-110050

Name of the Vulnerable Software and Affected Versions Topcontent versions prior to 1.2.2 Description An issue exists where a request handler is not properly authorized and HTML sanitization is disabled before storing submitted content. This allows unauthenticated attackers to publish arbitrary...

PT-2026-110058

Name of the Vulnerable Software and Affected Versions WP Posts Password Batch Manager versions prior to 1.2 Description The plugin fails to perform capability or nonce checks on a bulk post-password action executed via an always-loaded admin handler. This allows unauthenticated attackers to reset...

PT-2026-110047

The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN acce...

PT-2026-110056

Name of the Vulnerable Software and Affected Versions Recordbrowser WordPress plugin versions prior to 1.1.8 Description An issue exists where the software fails to sanitize and escape the recordid parameter before incorporating it into a SQL query. This allows unauthenticated attackers to perfor...

PT-2026-110070

Name of the Vulnerable Software and Affected Versions WP-Invoice versions prior to 4.3.2 Description Several AJAX handlers in the plugin fail to perform capability checks. This allows any authenticated user, including those with Subscriber level permissions, to retrieve personally identifiable...

PT-2026-110053

Name of the Vulnerable Software and Affected Versions Site Setup Wizard versions prior to 1.5.9 Description An issue exists where the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL statement. This allows unauthenticated attackers to execute SQL injecti...

PT-2026-110054

Name of the Vulnerable Software and Affected Versions Llavero.io versions prior to 0.1.5 Description An issue exists where the software fails to properly sanitize and escape the cill login parameter before incorporating it into a SQL statement. This allows unauthenticated attackers to execute SQL...

PT-2026-110061

Name of the Vulnerable Software and Affected Versions Loja Automática versions prior to 1.0.1 Description Unauthenticated users can perform SQL injection attacks because the plugin fails to properly sanitize and escape the id parameter before incorporating it into a SQL query. SQL injection is a...

PT-2026-110013

The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to view, allowing any user able to create and edit a gallery Author and above by default to disclose the title and excerpt of other...

PT-2026-110012

The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves for installing Envira Gallery WordPress plugin before 1.16.2 code before processing its setup-wizard Envira Gallery WordPress plugin before 1.16.2-installation request, and does n...

PT-2026-110023

The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputting it on a frontend page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing a gallery, includi...

PT-2026-110031

Name of the Vulnerable Software and Affected Versions click5 CRM add-on to Ninja Forms WordPress plugin versions prior to 1.0.2 Description An unauthenticated endpoint fails to sanitize and escape submitted content before it is displayed on an administrative page. This leads to Stored Cross-Site...

PT-2026-110010

Name of the Vulnerable Software and Affected Versions Mobile builder WordPress plugin versions prior to 1.4.3 Description Unauthenticated users can perform SQL injection attacks because the plugin fails to sanitize and escape a parameter before incorporating it into a SQL statement. SQL injection...

PT-2026-110015

The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing authors to embed and expose other users' non-public gallery metadata to unauthenticated visitors...

PT-2026-110039

Name of the Vulnerable Software and Affected Versions Crowdfundly WordPress plugin versions prior to 2.2.3 Description Insufficient capability checks on certain AJAX actions allow users with low-privileged roles to grant themselves the administrator role or arbitrary capabilities, which can resul...

PT-2026-110040

Name of the Vulnerable Software and Affected Versions Quick quotes WordPress plugin version 1.0.0 Description An issue exists where the plugin fails to perform capability or nonce checks on an AJAX action. This allows unauthenticated users to specify which option is written, enabling them to modi...

PT-2026-110035

Name of the Vulnerable Software and Affected Versions Mindstien Quick Login versions prior to 1.1 Description Improper session validation allows unauthenticated attackers to obtain an authenticated session for the account configured in the plugin. This occurs because the plugin does not correctly...

PT-2026-110022

The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in one of its gallery layouts, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected...

PT-2026-110043

Name of the Vulnerable Software and Affected Versions Web Vitals Tracking WordPress plugin versions prior to 5.4.3 Description Unauthenticated visitors can submit performance measurements that are stored and subsequently output within a script context on an administrative page without proper...

PT-2026-110024

The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputting them on the gallery edit screen, allowing users with the Contributor role and above to store JavaScript that executes in the context of an administrator who opens the gallery...