PT-2026-78249

Name of the Vulnerable Software and Affected Versions Draft List versions prior to 2.6.5 Description Improper neutralization of input during web page generation in the David Artiss Draft List simple-draft-list plugin allows for Stored Cross-site Scripting XSS. Stored XSS occurs when an applicatio...

PT-2026-77102

Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...

PT-2026-77120

Name of the Vulnerable Software and Affected Versions Restaurant Menu by MotoPress versions prior to 2.4.12 Description An unauthenticated Local File Inclusion LFI exists, which allows a remote attacker to read files from the server without requiring user interaction. Local File Inclusion is a...

PT-2026-78248

Name of the Vulnerable Software and Affected Versions HashBar – WordPress Notification Bar versions prior to 2.0.1 Description Cross-Site Request Forgery CSRF in DevItems HashBar – WordPress Notification Bar allows an attacker to induce a user to perform actions they did not intend to do. CSRF is...

PT-2026-77122

Name of the Vulnerable Software and Affected Versions Charitable versions prior to 1.8.11.4 Description An unauthenticated broken access control issue exists, allowing network exploitation without requiring user interaction. Recommendations Update to a version newer than 1.8.11.3...

PT-2026-77101

Name of the Vulnerable Software and Affected Versions JetAppointment versions prior to 2.5.3 Description An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its databas...

PT-2026-77057

Name of the Vulnerable Software and Affected Versions Ultimate Dashboard versions prior to 3.11.3 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication...

PT-2026-77062

Name of the Vulnerable Software and Affected Versions Modal Survey versions prior to 2.0.2.2.4 Description An Insecure Direct Object Reference IDOR exists, which occurs when an application provides direct access to objects based on user-supplied input, potentially allowing unauthorized access to...

PT-2026-77064

Contributor Cross Site Scripting XSS in Wise Chat = 3.4 versions...

PT-2026-77114

Name of the Vulnerable Software and Affected Versions Subscribe2 versions prior to 10.47 Description An unauthenticated Cross Site Scripting XSS issue exists in the Subscribe2 WordPress plugin. This flaw allows a remote attacker to execute malicious scripts in the browser of a user without...

PT-2026-77068

Name of the Vulnerable Software and Affected Versions Login With Ajax versions prior to 4.5.2 Description Cross Site Scripting XSS exists in the contributor section, allowing an attacker to execute malicious scripts in the browser of other users. Recommendations Update to a version newer than 4.5...

PT-2026-78246

Name of the Vulnerable Software and Affected Versions B2BKing versions prior to 5.2.31 Description A missing authorization issue allows the exploitation of incorrectly configured access control security levels. Recommendations Update B2BKing to version 5.2.31 or later...

PT-2026-76904

Name of the Vulnerable Software and Affected Versions WPAdverts – Classifieds Plugin versions prior to 2.3.3 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to retriev...

PT-2026-77060

Name of the Vulnerable Software and Affected Versions Kirki versions prior to 6.2.4 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user by injecting code into a web page. Recommendations Update to a...

PT-2026-77073

Name of the Vulnerable Software and Affected Versions WP Tab Widget versions prior to 1.2.12 Description Cross Site Scripting XSS allows an attacker with contributor privileges to execute malicious scripts in the browser of other users. Recommendations Update to a version newer than 1.2.11...

PT-2026-77124

Name of the Vulnerable Software and Affected Versions Masteriyo - LMS versions prior to 2.3.3 Description An unauthenticated arbitrary file upload issue exists, allowing an attacker to upload files to the server without requiring authentication. Recommendations Update Masteriyo - LMS to a version...

PT-2026-77117

Name of the Vulnerable Software and Affected Versions Youzify versions prior to 1.3.8 Description The software contains an unauthenticated deserialization flaw. This issue allows an attacker to process untrusted data without requiring authentication or user interaction, making it exploitable over...

PT-2026-77067

Contributor Cross Site Scripting XSS in WPZOOM Forms – Contact Form Plugin for Gutenberg = 2.0.4 versions...

PT-2026-77125

Name of the Vulnerable Software and Affected Versions Starter Templates by Kadence WP versions prior to 2.3.4 Description An unauthenticated Denial of Service DoS issue exists, allowing a remote attacker to cause the application to become unavailable without requiring authentication...

PT-2026-77065

Name of the Vulnerable Software and Affected Versions Featured Video Plus versions prior to 2.3.4 Description Cross Site Scripting XSS allows an attacker with contributor privileges to execute malicious scripts in the browser of other users. Recommendations Update to a version newer than 2.3.3...