EUVD-2026-97244

The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site...

CVE-2025-15703

The HireZoot WordPress plugin versions prior to 4.0.0 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to properly sanitise and escape one of the job specification settings before it is reflected on an admin-area settings page. This allows users with management cap...

EUVD-2025-211060

The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability Administrator by default to store a...

WordPress Hotel Booking plugin <= 3.8 - Subscriber+ Booking Order PII Disclosure vulnerability

Subscriber+ Booking Order PII Disclosure vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Hotel Booking versions = 3.8...

CVE-2025-15703 WP Job Openings < 4.0.0 - Admin+ Stored XSS

The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability Administrator by default to store a...

EUVD-2026-97243

The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request...

CVE-2026-108481: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.10.0...

CVE-2026-108479: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.9.17...

CVE-2026-84167: Authorization Bypass Through User-Controlled Key

The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referenci...

CVE-2026-84166: Cross-Site Request Forgery (CSRF)

The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request...

PT-2026-122575

Name of the Vulnerable Software and Affected Versions Muzicon versions prior to 1.16 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of gadgets...

PT-2026-122582

Name of the Vulnerable Software and Affected Versions Edge Decor versions prior to 2.10 Description Unauthenticated attackers can perform PHP Object Injection due to the deserialization of untrusted input. While no POP chain a sequence of gadgets used to achieve code execution is present in the...

PT-2026-122578

Name of the Vulnerable Software and Affected Versions Filmax versions prior to 1.1.12 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of gadget...

PT-2026-122581

Name of the Vulnerable Software and Affected Versions Coinpress versions prior to 1.0.16 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of...

PT-2026-122584

Name of the Vulnerable Software and Affected Versions Gamezone versions prior to 1.1.12 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of...

PT-2026-122571

Name of the Vulnerable Software and Affected Versions Le Truffe versions prior to 1.1.8 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of...

WordPress Forminator Forms 1.56.1 Arbitrary File Upload

WordPress Forminator Forms version 1.56.1 and earlier contains an unauthenticated arbitrary file upload vulnerability via forged upload field configuration that may lead to remote code execution when uploaded PHP files can execute. https://packetstorm.news/download/235228...

PT-2026-122586

Name of the Vulnerable Software and Affected Versions Good Homes versions prior to 1.3.14 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of...

PT-2026-122585

Name of the Vulnerable Software and Affected Versions Gamic versions prior to 1.20 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of gadgets...

PT-2026-110478

Name of the Vulnerable Software and Affected Versions Hotel Booking versions prior to 3.9 Description Cross-Site Request Forgery CSRF occurs when a web application fails to verify that a request was intentionally initiated by the user. The administrative booking order management lacks CSRF...