PT-2026-72145

Name of the Vulnerable Software and Affected Versions Propovoice: All-in-One Client Management System versions prior to 1.7.9 Description An issue exists where the REST endpoint of the create function fails to validate the user-supplied role parameter against a list of permitted WordPress roles a...

PT-2026-72362

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A self-deadlock occurs in the Linux kernel when a PAGEMAP SCAN ioctl requests PM SCAN WP MATCHING on a hugetlb VMA. The issue arises when the scan reaches an unpopulated part of the rang...

Exploit for CVE-2026-52715

GeoLeak — PoC de CVE-2026-52715 Proof of Concept educativa...

Exploit for CVE-2026-12345

CVE-2026-64638 - WordPress wp-login.php Reflected XSS "XSS2...

WordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by hhhai in WordPress Plugin WP Sort Order versions = 1.3.5...

WordPress Starter Templates by Kadence WP plugin <= 2.3.3 - Denial of Service Attack vulnerability

Denial of Service Attack vulnerability discovered by Asim Alshaya in WordPress Plugin Starter Templates by Kadence WP versions = 2.3.3...

WordPress WP Helper Premium plugin < 4.7.6 - Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key Validation vulnerability

Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key Validation vulnerability discovered by Farid Narimanov in WordPress Plugin WP Helper Premium versions 4.7.6...

CVE-2026-19794

The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...

WordPress ProSolution WP Client plugin < 2.0.9 - Subscriber+ proSol_ajaxTablesync and proSol_ajaxClearlog Calls vulnerability

Subscriber+ proSolajaxTablesync and proSolajaxClearlog Calls vulnerability discovered by Nir Yehoshua in WordPress Plugin ProSolution WP Client versions 2.0.9...

WordPress WP Photo Album Plus plugin < 9.2.09.002 - Subscriber+ Cross-Album File Upload via Missing Authorization vulnerability

Subscriber+ Cross-Album File Upload via Missing Authorization vulnerability discovered by Farid Narimanov in WordPress Plugin WP Photo Album Plus versions 9.2.09.002...

CVE-2026-19794 WP-Stats <= 2.56 - Unauthenticated Stored Cross-Site Scripting

The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...

CVE-2026-19794

The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...

CVE-2026-19794

The CVE-2026-19794 entry concerns the WP-Stats plugin for WordPress, affected in all versions up to and including 2.56. Root cause: insufficient input sanitization and output escaping, enabling Stored Cross-Site Scripting. Impact: unauthenticated attackers can inject arbitrary web scripts that ex...

EUVD-2026-58607

The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...

CVE-2026-19794 WP-Stats <= 2.56 - Unauthenticated Stored Cross-Site Scripting

The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...

WordPress WP Photo Album Plus plugin < 9.2.07.002 - Unauthenticated Option Disclosure via gettogo vulnerability

Unauthenticated Option Disclosure via gettogo vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Photo Album Plus versions 9.2.07.002...

WordPress WP Crowdfunding plugin < 2.2.1 - Subscriber+ Campaign Creation via Missing Authorization vulnerability

Subscriber+ Campaign Creation via Missing Authorization vulnerability discovered by Sajjad Haqi in WordPress Plugin WP Crowdfunding versions 2.2.1...

WordPress Import WP plugin < 2.14.23 - Unauthenticated Sensitive Information Exposure via Export File Download vulnerability

Unauthenticated Sensitive Information Exposure via Export File Download vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Import WP versions 2.14.23...

WordPress WP Crowdfunding plugin < 2.2.1 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Jakub Herman in WordPress Plugin WP Crowdfunding versions 2.2.1...

WordPress WP Crowdfunding plugin < 2.2.1 - Subscriber+ Campaign Update Modification via IDOR vulnerability

Subscriber+ Campaign Update Modification via IDOR vulnerability discovered by Sanjorn Keeratirungsan in WordPress Plugin WP Crowdfunding versions 2.2.1...