PT-2026-78990

Name of the Vulnerable Software and Affected Versions Smart Cleaning versions prior to 4.8.7 Description An arbitrary file upload issue exists that allows users with subscriber privileges to upload unauthorized files to the system. Recommendations Update to a version newer than 4.8.6...

PT-2026-78975

Name of the Vulnerable Software and Affected Versions Directory Pro versions prior to 2.5.9 Description An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its database...

PT-2026-78973

Name of the Vulnerable Software and Affected Versions Form Maker by 10Web versions prior to 1.15.47 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication...

PT-2026-78992

Name of the Vulnerable Software and Affected Versions EPROLO Dropshipping versions prior to 2.4.3 Description Broken access control allows unauthenticated users to gain unauthorized access to restricted areas or functions of the system. Recommendations Update to a version newer than 2.4.2...

PT-2026-78888

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the eme single event page template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrar...

PT-2026-78991

Name of the Vulnerable Software and Affected Versions Warehouse Cargo versions prior to 2.7.0 Description An issue allows subscribers to perform arbitrary file uploads, which could lead to the upload of unauthorized files to the server. Recommendations Update to a version newer than 2.6.9...

PT-2026-78895

Name of the Vulnerable Software and Affected Versions JSON Options versions prior to 0.0.5 Description The JSON Options WordPress plugin lacks capability checks and nonce verification on an action that executes on every request. This allows unauthenticated users to update arbitrary WordPress...

PT-2026-78976

Name of the Vulnerable Software and Affected Versions Flatastic versions prior to 2.1 Description An unauthenticated PHP Object Injection issue exists. PHP Object Injection occurs when untrusted input is passed to the unserialize function, allowing an attacker to manipulate serialized objects and...

PT-2026-78968

Unauthenticated SQL Injection in TheGem Elementor = 5.12.3 versions...

PT-2026-78980

Name of the Vulnerable Software and Affected Versions Abandoned Cart Pro for WooCommerce versions prior to 10.4.1 Description An issue allows unauthenticated users to perform privilege escalation. Recommendations Update Abandoned Cart Pro for WooCommerce to version 10.4.1 or later...

PT-2026-78974

Name of the Vulnerable Software and Affected Versions Homlisti versions prior to 3.1.3 Description Broken access control exists for subscribers, allowing unauthorized access or actions. Recommendations Update to a version newer than 3.1.2...

NPM: SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses

NPM: SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses vulnerability discovered by ? in WordPress Npm mcp-searxng versions 1.12.0...

NPM: SearXNG MCP Server: Additional hardened-mode SSRF bypasses

NPM: SearXNG MCP Server: Additional hardened-mode SSRF bypasses vulnerability discovered by ? in WordPress Npm mcp-searxng versions 1.2.1...

CVE-2026-18315

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the adminusercreatecus AJAX handler lacking any authentication o...

CVE-2026-18315 TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the adminusercreatecus AJAX handler lacking any authentication o...

CVE-2026-18315

The TrueBooker – Appointment Booking and Scheduler System WordPress plugin (all versions ≤ 1.2.6 ) contains an unauthenticated authorization bypass in the admin_user_create_cus AJAX handler. The handler passes the attacker-controlled truebooker_wp_user_id parameter directly to wp_update_user with...

EUVD-2026-62630

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the adminusercreatecus AJAX handler lacking any authentication o...

CVE-2026-32475

Elementor Pro WordPress plugin (≈6,000,000 active installations) is vulnerable to unauthenticated arbitrary file upload in all versions up to and including 4.2.1 . The root cause is a logic error in the Upload::validation() function where return is used instead of continue when the first array el...

EUVD-2026-62595

Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1...

CVE-2026-32475 WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1...