CVE-2026-84096: Improper Neutralization of Input During Web Page Generation

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that saves its review submission forms, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to overwrite a live form with...

CVE-2026-16591: Improper Neutralization of Input During Web Page Generation

The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category and location fields before outputting them in page attributes, allowing users with a WP Directory Kit WordPress plugin before 1.5.8-specific listing-management role and without the unfilteredhtml...

PT-2026-99243

Name of the Vulnerable Software and Affected Versions wp-review-slider-pro versions prior to 12.7.12 Description The plugin fails to perform a capability check on the AJAX handler used to save review submission forms. Additionally, the nonce a unique token used to prevent replay attacks is...

PT-2026-99240

Name of the Vulnerable Software and Affected Versions WP Directory Kit WordPress plugin versions prior to 1.5.8 Description Insufficient sanitization and escaping of category and location fields before they are output in page attributes allows users with a listing-management role to perform Store...

PT-2026-99247

Name of the Vulnerable Software and Affected Versions WP Delicious WordPress plugin versions prior to 1.10.8 Description Insufficient validation and escaping of HTML tag names derived from user-supplied recipe block data allows users with the Contributor role and above to inject arbitrary HTML...

CVE-2026-84095: Improper Neutralization of Input During Web Page Generation

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one of its AJAX handlers, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to store arbitrary review content which is later output...

PT-2026-99412

Name of the Vulnerable Software and Affected Versions miniOrange OTP Login, Verification and SMS Notifications versions prior to 5.5.6 Description An authentication bypass exists when the mo wp login intent parameter is used. The issue occurs within the mo by pass login function, specifically in...

CVE-2026-84097: Improper Neutralization of Special Elements used in an SQL Command

The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are...

PT-2026-99411

Name of the Vulnerable Software and Affected Versions Groups – Memberships and Access Control versions prior to 4.6.1 Description An issue exists where the groups join function determines group-join eligibility based on the author capabilities of the ambient post via the global $post-post author...

PT-2026-99244

Name of the Vulnerable Software and Affected Versions wp-review-slider-pro versions prior to 12.7.12 Description An issue exists where a value stored through an AJAX handler is not sanitized before being used in a SQL statement. The handler also lacks a capability check, which allows any...

CVE-2026-92411: Improper Neutralization of Input During Web Page Generation

The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, allowing users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute whe...

PT-2026-99242

Name of the Vulnerable Software and Affected Versions wp-review-slider-pro versions prior to 12.7.12 Description An issue exists where an AJAX handler fails to perform a capability check. Because the nonce protecting this handler is generated for every visitor, any authenticated user, including...

WordPress WP Data Access plugin <= 5.5.84 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Raphael P. Cigana in WordPress Plugin WP Data Access versions = 5.5.84...

WordPress WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings plugin <= 4.9.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin WP Maps versions = 4.9.8...

WordPress AMP for WP – Accelerated Mobile Pages plugin <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Pham Duc Anh in WordPress Plugin AMP for WP versions = 1.1.16...

CVE-2026-13179

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shapesvalues Parameter in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes ...

CVE-2026-13456

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authenticated attackers, with...

Exploit for CVE-2026-14281

CVE-2026-14281 — WAWP Automation Web Platform Unauthenticate...

EUVD-2026-86600

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shapesvalues Parameter in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes ...

CVE-2026-13179 WP Maps <= 4.9.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via shapes_values Parameter

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shapesvalues Parameter in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes ...