CVE-2026-88827: Improper Authentication

The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with the account's full privileges...

CVE-2026-87761: Improper Neutralization of Input During Web Page Generation

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwrite its site-wide configuration, and does not escape those configuration values before printing them inside an inline script block on ever...

CVE-2026-94235: Missing Authorization

The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to make the site send arbitrary HTML emails to arbitrary recipients from its own mail system, which can be abused to relay...

PT-2026-110014

The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that the requester can edit an arbitrary post they name rather than that they are allowed to create the Envira Gallery WordPress plugin before 1.16.2's own gallery...

PT-2026-110044

Name of the Vulnerable Software and Affected Versions Adwised Web Push Notification versions prior to 2.5.8 Description An authenticated user, including those with subscriber-level privileges, can overwrite site-wide configuration settings because the plugin fails to perform capability or nonce...

CVE-2026-108695: Incorrect Authorization

MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the storeowner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only...

CVE-2026-104682: Missing Authorization

The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that the requester can edit an arbitrary post they name rather than that they are allowed to create the Envira Gallery WordPress plugin before 1.16.2's own gallery...

CVE-2026-88905: Improper Neutralization of Input During Web Page Generation

The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector...

CVE-2026-88903: Improper Neutralization of Input During Web Page Generation

The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted content, allowing unauthenticated attackers to publish arbitrary posts containing malicious JavaScript on any site where its API key ha...

CVE-2026-107507: Incorrect Authorization

The Squadeno WordPress plugin before 1.12.0 does not enforce its restrictions on every way a sport can be saved, allowing users with the lowest-tier Trainer role to change the section, age group, author, password, comment settings and date of a sport they are assigned to...

PT-2026-110022

The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in one of its gallery layouts, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected...

PT-2026-110045

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has never been set, allowing unauthenticated users to store...

PT-2026-110053

Name of the Vulnerable Software and Affected Versions Site Setup Wizard versions prior to 1.5.9 Description An issue exists where the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL statement. This allows unauthenticated attackers to execute SQL injecti...

PT-2026-110038

Name of the Vulnerable Software and Affected Versions Insurify WordPress plugin version 1.0 Description An issue exists where an AJAX action lacks authorization and nonce checks. This allows unauthenticated users to create or overwrite arbitrary WordPress options using request data, which can...

PT-2026-110023

The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputting it on a frontend page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing a gallery, includi...

PT-2026-110059

Name of the Vulnerable Software and Affected Versions Datalist it versions prior to 0.0.4 Description The Datalist it WordPress plugin fails to sanitize and escape several request parameters used in the construction of SQL queries. This allows unauthenticated attackers to execute SQL injection...

CVE-2026-103305: Improper Neutralization of Input During Web Page Generation

The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors...

PT-2026-110042

Name of the Vulnerable Software and Affected Versions HootBoard WordPress plugin versions prior to 3.1.5 Description The plugin fails to perform authorization checks on certain REST endpoints and does not escape stored values before they are displayed on public pages. This allows unauthenticated...

PT-2026-110062

Name of the Vulnerable Software and Affected Versions WP Verify API versions prior to 1.0.1 Description Unauthenticated users can perform SQL injection attacks because the plugin fails to properly sanitize and escape the verify parameter before incorporating it into a SQL query. SQL injection is ...

CVE-2026-103695: Improper Neutralization of Special Elements used in an SQL Command

The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...