PT-2026-133296

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.8.6 This is due to the MCP module's OAuth 2.1 Dynamic Client Registration endpoint /wp-json/mcp/v1/oauth/register being registered with...

PT-2026-133286

The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecting them into HTML attributes in a publicly reachable AJAX response, leading to Reflected Cross-Site Scripting. The affected action is gated by an anonymous nonce that only...

PT-2026-133695

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2026-133690

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the setSupportCustomImage function in all versions up to, and including, 5.0.1. This makes it possible for authenticated attackers, wi...

PT-2026-133721

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the legacy render function. This is due to broken authorization on the Lightroom gallery edit endpoint combined with mass...

PT-2026-134439

Name of the Vulnerable Software and Affected Versions PDF Invoices & Packing Slips for WooCommerce versions prior to 5.16.5 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts through...

PT-2026-134445

Name of the Vulnerable Software and Affected Versions Webmention plugin for WordPress versions prior to 5.10.2 Description Stored Cross-Site Scripting occurs via the Open Graph og:title meta tag of a webmention source URL. The issue stems from insufficient input sanitization where Meta::add...

PT-2026-134450

Name of the Vulnerable Software and Affected Versions WP Job Portal – AI-Powered Recruitment System for Company or Job Board website versions prior to 2.7.1 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with...

CVE-2026-115346: ThemeFusion Avada | Website Builder For WordPress & WooCommerce: The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in…

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convertpaletteimagestotruecolor function. This is due to insufficient file type validation before processing uploaded files. This mak...

PT-2026-133691

The Independent Analytics Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm campaign' parameter in all versions up to, and including, 2.15.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-114422: Unknown Enable Media Replace: The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored…

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a...

PT-2026-133701

The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'columns array keys' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of...

PT-2026-133702

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font tb cf posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta: Themify...

CVE-2026-119714: joedolson My Calendar - Accessible Event Manager: My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows…

My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mcsearchresults in src/my-calendar-search.php without bracket encoding before...

CVE-2026-103039: Gravity Forms: The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including,…

The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::createpost passing the submitted value to WordPress' unrestricted global maybeunserialize rather...

WordPress Akismet 3.1.4 Cross Site Scripting

WordPress Akismet plugin versions 2.5.0 through 3.1.4 contain a stored cross site scripting vulnerability. This proof of concept submits a crafted payload that executes when viewed by an administrator. https://packetstorm.news/download/238548...

PT-2026-133697

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.2.7 via the process. This makes it possible for unauthenticated attackers to extract sensitive data including the WordPress password hash of any user...

CVE-2026-118165: Unknown Firelight Lightbox: The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox…

The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it into the page as HTML, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against users who click a...

CVE-2026-118100: Unknown BuddyForms: The BuddyForms WordPress plugin before 2.10.3 does not check that the requester is allowed to manage a form before…

The BuddyForms WordPress plugin before 2.10.3 does not check that the requester is allowed to manage a form before exporting its configuration, allowing unauthenticated users to download any form's stored settings, including notification recipient email addresses and reCAPTCHA secret keys that ar...

PT-2026-133289

The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including...