CVE-2026-73344: Improper Neutralization of Input During Web Page Generation

Author Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...

PT-2026-71534

Unauthenticated Cross Site Scripting XSS in WP Full Stripe Free = 8.5.0 versions...

CVE-2026-28174: Insertion of Sensitive Information Into Sent Data

Customer Sensitive Data Exposure in WP Event SOlution = 4.1.18 versions...

PT-2026-71523

Customer Sensitive Data Exposure in WP Event SOlution = 4.1.18 versions...

PT-2026-71522

Customer Arbitrary Content Deletion in WP Event SOlution = 4.1.19 versions...

PT-2026-71548

Unauthenticated Cross Site Scripting XSS in WP-Stats = 2.56 versions...

PT-2026-71540

Unauthenticated Cross Site Scripting XSS in Mang Board WP = 2.3.4 versions...

PT-2026-71393

Name of the Vulnerable Software and Affected Versions WP Helper Premium versions prior to 4.7.6 Description Insufficient verification of the order key occurs when rendering the custom order confirmation page or handling related AJAX actions. This allows unauthenticated users to view personal...

CVE-2026-28173: Missing Authorization

Customer Arbitrary Content Deletion in WP Event SOlution = 4.1.19 versions...

PT-2026-71535

Unauthenticated Arbitrary Code Execution in WP BASE Booking = 6.3.0 versions...

PT-2026-71561

Unauthenticated Broken Access Control in WP Social Avatar = 1.5 versions...

CVE-2026-66426: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WP-Stats = 2.56 versions...

CVE-2026-66454: Missing Authorization

Unauthenticated Broken Access Control in WP Social Avatar = 1.5 versions...

WordPress WP Data Access plugin <= 5.5.79 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Data Access versions = 5.5.79...

WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Jayant Kamble in WordPress Plugin WP Directory Kit versions = 1.5.4...

GHSA-VWF4-M7J8-WCJF

creationtimestamp| type| source ---|---|--- 2026-08-12 08:00:05+00:00| seen| Telegram/ZtTgk35S8DFYm2bUVjFVqqtPnGYEzTcbCUrks9IGhgQhA 2026-08-13 00:00:43+00:00| published-proof-of-concept| Telegram/ZtTgk35S8DFYm2bUVjFVqqtPnGYEzTcbCUrks9IGhgQhA 2026-08-16 20:29:14+00:00| seen|...

CVE-2026-19052

The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published on its public frontend, allowing any authenticated user, such as a subscriber, to trigger an administrative data synchronisation a...

CVE-2026-18962

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the...

CVE-2026-19050

The ProSolution WP Client WordPress plugin before 2.0.9 does not validate a user-supplied URL, and does not check the capability or nonce of the requester, before performing a server-side HTTP request with it, allowing any authenticated user, such as a subscriber, to make the site issue arbitrary...

CVE-2026-18474

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured...