WordPress Database Cleaner: Cleanup, Optimization & Repair plugin <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletion vulnerability

Authenticated Administrator+ Arbitrary Table Deletion vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Database Cleaner versions = 1.4.7...

PT-2026-133285

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress...

PT-2026-134464

Name of the Vulnerable Software and Affected Versions Seraphinite Accelerator versions prior to 2.29.25 Description An issue exists in the WP Object Cache:: getFilePath function that allows unauthenticated attackers to extract complete WordPress user records. This includes plaintext user login,...

PT-2026-133558

Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/page id route and the save page data, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middlewar...

PT-2026-133293

The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it into the page as HTML, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against users who click a...

PT-2026-134448

Name of the Vulnerable Software and Affected Versions VikRentCar Car Rental Management System versions prior to 1.5.0 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. By manipulating the poplink parameter, an...

PT-2026-133706

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the listing description post content in versions up to, and including, 2.8.199 This is due to insufficient input sanitization on save the bundled...

CVE-2025-8574: tigroumeow: The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and…

The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7. This is due to a lack of restriction on database tables that can be deleted. This makes it possible for authenticated attackers, with Administrator-level access and...

PT-2026-134459

Name of the Vulnerable Software and Affected Versions UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress versions prior to 1.2.79 Description Unauthorized account access is possible due to the use of predictable passwords for built-in dummy us...

CVE-2026-105894: akbilisim Ak Framework: The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Magazine WordPress Theme, is vulnerable to…

The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Magazine WordPress Theme, is vulnerable to Privilege Escalation in all versions up to, and including, 2.9.8. This is due to missing capability checks in the ajaxrefreshnonce and akadminajax handlers before passing...

CVE-2026-116622: wpscripts Food Store – Online Food Delivery & Pickup: The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…

The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'servicetime' parameter in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

PT-2026-134446

Name of the Vulnerable Software and Affected Versions W3 Total Cache versions prior to 2.10.8 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique where malicious scripts are permanently stored on a...

PT-2026-133281

The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts function in versions up to, and including, 12.0.0. The handler verifies a static nonce 'contentegg metabox' and the generic 'edit posts'...

PT-2026-134456

Name of the Vulnerable Software and Affected Versions User Submitted Posts – Enable Users to Submit Posts from the Front End versions prior to 20260917 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored DOM-Based Cross-Site Scripting...

CVE-2026-119087: keywordrush Content Egg – Affiliate Product Importer & Price Comparison: The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to authorization…

The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 12.0.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

PT-2026-133724

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previous draft id' parameter due to missing validation on a user controlled key. This makes it...

CVE-2026-109984: foliovision FV Flowplayer Video Player: The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment'…

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

WordPress Transliterator SQL injection vulnerability

WordPress Transliterator versions 2.5.13 and earlier contain an SQL injection vulnerability. This vulnerability arises from insufficient sanitization of special elements, allowing unauthenticated attackers to exploit it...

CVE-2026-110533: foliovision FV Flowplayer Video Player: The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fvplayervideosfvplayeruservideo' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

PT-2026-133278

The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the ' elementor data.form fields.custom id' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping...