CVE-2026-62085: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in WP Activity Log = 5.6.6 versions...

CVE-2026-102386: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in WP Photo Album Plus = 9.3.02.003 versions...

CVE-2026-16596: Improper Neutralization of Special Elements used in an SQL Command

The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'datafieldslist' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-91832: Improper Neutralization of Input During Web Page Generation

The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output...

PT-2026-103507

Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...

PT-2026-103191

Author SQL Injection in WP ERP = 1.17.9 versions...

PT-2026-103157

Unauthenticated SQL Injection in WP Data Access = 5.5.84 versions...

PT-2026-103203

Unauthenticated Broken Access Control in WP Express Checkout Accept PayPal Payments = 2.4.9 versions...

PT-2026-103054

The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'data fields list' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

PT-2026-103041

The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output...

CVE-2026-96825: Authentication Bypass by Spoofing

Subscriber Bypass Vulnerability in All In One WP Security & Firewall = 5.4.8 versions...

WordPress WP Directory Kit plugin <= 1.5.4 - Authenticated (Custom+) SQL Injection vulnerability

Authenticated Custom+ SQL Injection vulnerability discovered by zickzick2 in WordPress Plugin WP Directory Kit versions = 1.5.4...

CVE-2026-8732-EXPLOIT

CVE-2026-8732 – WordPress WP Maps Pro Exploit 인증되지 않은 관리자 계정 탈취 | CVSS 9.8 | 즉시 사용 가능 🔥 제공 내용 CVE-2026-8732용 완전 작동 Python 익스플로잇 인증 없는 관리자 계정 생성 매직 로그인 URL 반환 – 즉시 사이트 장악 WP Maps Pro ≤ 6.1.0에서 작동 무흔적, 깔끔, 기본적으로 로그 미남김 ⚡ 왜 저희를 선택해야 하나요 50개 이상의 취약한 대상에서 테스트 완료 불필요한 코드 없음 – 순수 익스플로잇 레드 팀, 모의 침투, 버그...

WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Morato Antoine in WordPress Plugin WP Express Checkout Accept PayPal Payments versions = 2.4.9...

WordPress WP Review Slider Pro plugin < 12.7.12 - Subscriber+ Stored XSS vulnerability

Subscriber+ Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Review Slider Pro versions 12.7.12...

WordPress Paymattic plugin 4.6.20-4.6.25 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Artus KG in WordPress Plugin Best Payments Plugin for WP versions 4.6.20-4.6.25...

WordPress WP Review Slider Pro plugin < 12.7.12 - Subscriber+ Stored XSS vulnerability

Subscriber+ Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Review Slider Pro versions 12.7.12...

WordPress WP Review Slider Pro plugin < 12.7.12 - Subscriber+ SQLi vulnerability

Subscriber+ SQLi vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Review Slider Pro versions 12.7.12...

WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP ERP versions = 1.17.9...

CVE-2026-89300

The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data into its own database table, as well as to make the site send templated verification emails to arbitrary email addresses. The...