PT-2026-122580

Name of the Vulnerable Software and Affected Versions Bonbon versions prior to 1.12 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of gadgets...

PT-2026-122583

Name of the Vulnerable Software and Affected Versions EmojiNation versions prior to 1.0.13 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of...

PT-2026-122577

Name of the Vulnerable Software and Affected Versions Orpheus versions prior to 1.9 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of gadgets...

PT-2026-122573

Name of the Vulnerable Software and Affected Versions Mission versions prior to 1.23 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of gadgets...

PT-2026-110474

The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site...

PT-2026-110867

Attackers exploited CVE-2024-85097, a critical CVSS 10.0 WordPress vulnerability, using GIF/PHP polyglot files to achieve unauthenticated remote code execution. Campaign involved 63 unique IP addresses targeting Bricksforge plugin installations for web shell deployment. ZeroDay WordPressSecurity ...

PT-2026-110856

Cross-Site Request Forgery CSRF vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.10.0...

PT-2026-110855

Cross-Site Request Forgery CSRF vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.9.17...

PT-2026-122569

Name of the Vulnerable Software and Affected Versions Auction Nudge – Your eBay on Your Site versions prior to 8.4.1 Description Stored Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts...

PT-2026-122572

Name of the Vulnerable Software and Affected Versions Meals & Wheels versions prior to 1.1.14 Description Unauthenticated attackers can perform PHP Object Injection due to the deserialization of untrusted input. While no POP chain a sequence of gadgets used to achieve code execution is present in...

PT-2026-122576

Name of the Vulnerable Software and Affected Versions Nuts versions prior to 1.13 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of gadgets us...

PT-2026-122579

Name of the Vulnerable Software and Affected Versions Avventure versions prior to 1.1.13 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of...

PT-2026-122587

Name of the Vulnerable Software and Affected Versions Gunslinger versions prior to 1.12 Description The Gunslinger theme for WordPress allows unauthenticated attackers to perform PHP Object Injection due to the deserialization of untrusted input. This occurs when the application processes data th...

PT-2026-122574

Name of the Vulnerable Software and Affected Versions Motorix versions prior to 1.12 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of gadgets...

CVE-2026-107791: Missing Authorization

The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site...

PT-2026-110473

The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability Administrator by default to store a...

VulnCheck KEV: CVE-2026-0702

The VidShop – Shoppable Videos for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

PT-2026-122570

Name of the Vulnerable Software and Affected Versions Legal Stone versions prior to 1.2.12 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of...

PT-2026-110479

Name of the Vulnerable Software and Affected Versions Hotel Booking versions prior to 3.9 Description An Insecure Direct Object Reference IDOR exists where the software fails to verify if a booking record belongs to the user requesting it. This allows any authenticated user, such as a Subscriber,...

WordPress Ad Inserter Cross-Site Script Vulnerability

WordPress Ad Inserter 2.8.18 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from improper input during web page generation, and could lead to stored-xss attacks...