PT-2026-122573

Name of the Vulnerable Software and Affected Versions Mission versions prior to 1.23 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of gadgets...

PT-2026-110855

Cross-Site Request Forgery CSRF vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.9.17...

PT-2026-110474

The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site...

PT-2026-122577

Name of the Vulnerable Software and Affected Versions Orpheus versions prior to 1.9 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of gadgets...

CVE-2025-15703: Improper Neutralization of Input During Web Page Generation

The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability Administrator by default to store a...

PT-2026-122580

Name of the Vulnerable Software and Affected Versions Bonbon versions prior to 1.12 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of gadgets...

PT-2026-122583

Name of the Vulnerable Software and Affected Versions EmojiNation versions prior to 1.0.13 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of...

PT-2026-110479

Name of the Vulnerable Software and Affected Versions Hotel Booking versions prior to 3.9 Description An Insecure Direct Object Reference IDOR exists where the software fails to verify if a booking record belongs to the user requesting it. This allows any authenticated user, such as a Subscriber,...

PT-2026-122569

Name of the Vulnerable Software and Affected Versions Auction Nudge – Your eBay on Your Site versions prior to 8.4.1 Description Stored Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts...

PT-2026-122579

Name of the Vulnerable Software and Affected Versions Avventure versions prior to 1.1.13 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of...

PT-2026-122574

Name of the Vulnerable Software and Affected Versions Motorix versions prior to 1.12 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of gadgets...

PT-2026-122576

Name of the Vulnerable Software and Affected Versions Nuts versions prior to 1.13 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of gadgets us...

CVE-2026-107791: Missing Authorization

The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site...

VulnCheck KEV: CVE-2026-0702

The VidShop – Shoppable Videos for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

PT-2026-122587

Name of the Vulnerable Software and Affected Versions Gunslinger versions prior to 1.12 Description The Gunslinger theme for WordPress allows unauthenticated attackers to perform PHP Object Injection due to the deserialization of untrusted input. This occurs when the application processes data th...

PT-2026-122570

Name of the Vulnerable Software and Affected Versions Legal Stone versions prior to 1.2.12 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of...

PT-2026-122572

Name of the Vulnerable Software and Affected Versions Meals & Wheels versions prior to 1.1.14 Description Unauthenticated attackers can perform PHP Object Injection due to the deserialization of untrusted input. While no POP chain a sequence of gadgets used to achieve code execution is present in...

PT-2026-110473

The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability Administrator by default to store a...

WordPress Event Post Authorization Issue Vulnerability

WordPress Event post 6.1.1 and earlier versions have a vulnerability related to authorization settings. This vulnerability stems from improper access control configurations, which may allow unauthorized access...

WordPress Ad Inserter Cross-Site Script Vulnerability

WordPress Ad Inserter 2.8.18 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from improper input during web page generation, and could lead to stored-xss attacks...