CVE-2026-16562: Exposure of Sensitive Information to an Unauthorized Actor

The WP Statistics WordPress plugin before 14.16.10 does not perform a capability check on a set of dashboard analytics AJAX handlers, relying only on a nonce that every authenticated user holds, allowing users with Subscriber-level access and above to disclose the site's visitor analytics data...

PT-2026-69174

Name of the Vulnerable Software and Affected Versions WP Statistics versions prior to 14.16.10 Description Insufficient capability checks in a set of dashboard analytics AJAX handlers allow authenticated users with Subscriber-level access and above to disclose sensitive site visitor analytics dat...

PT-2026-69178

Name of the Vulnerable Software and Affected Versions WP Directory Kit versions prior to 1.5.5 Description An issue exists where the plugin fails to perform authorization or nonce checks on an authenticated AJAX action. This allows any authenticated user, including those with Subscriber privilege...

PT-2026-69180

Name of the Vulnerable Software and Affected Versions WP Directory Kit versions prior to 1.5.5 Description An issue exists where the plugin fails to perform authorization or nonce checks on an authenticated AJAX action. This allows any authenticated user, including those with Subscriber privilege...

CVE-2026-16265

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service...

CVE-2026-16263 WP Maps < 4.9.7 - Subscriber+ Local File Inclusion

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on...

CVE-2026-16265 WP Maps < 4.9.7 - Subscriber+ Denial of Service

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service...

CVE-2026-16263 WP Maps < 4.9.7 - Subscriber+ Local File Inclusion

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on...

CVE-2026-15032 wpDiscuz < 7.6.60 - Unauthenticated Stored XSS via Image URL Conversion

The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing unauthenticated users to store a Cross-Site Scripting payload that executes in the browser of any user, including administrators, who views the affected...

CVE-2026-14205

The WP Events Manager WordPress plugin (versions before 2.2.5 ) is vulnerable to a payment bypass due to improper validation of the requested quantity when registering for paid events. An authenticated user can manipulate the attacker-controlled quantity parameter to cause the system to compute a...

CVE-2026-14205 WP Events Manager < 2.2.5 - Subscriber+ Payment Bypass via 'qty' Parameter

The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment...

WordPress WP-Stats plugin <= 2.56 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by testoun in WordPress Plugin WP-Stats versions = 2.56...

PT-2026-68875

Name of the Vulnerable Software and Affected Versions WP Events Manager versions prior to 2.2.5 Description The plugin fails to verify if incoming payment notifications originate from the configured merchant account and does not check if the paid amount matches the booking total. This allows...

CVE-2026-14205: Improper Authentication

The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment...

CVE-2026-16265: Uncontrolled Resource Consumption

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service...

PT-2026-68873

Name of the Vulnerable Software and Affected Versions WP Maps versions prior to 4.9.7 Description An issue exists where the plugin fails to perform a capability check in an AJAX action and does not restrict the dispatched operation. This allows users with a Subscriber account to trigger...

PT-2026-68856

Name of the Vulnerable Software and Affected Versions WP Events Manager versions prior to 2.2.5 Description An issue exists where the plugin fails to validate the requested quantity during registration for paid events. Because the price is computed based on a quantity controlled by the user, any...

CVE-2026-16263: Improper Limitation of a Pathname to a Restricted Directory

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on...

CVE-2026-15148: Insufficient Verification of Data Authenticity

The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate...

PT-2026-68872

Name of the Vulnerable Software and Affected Versions WP Maps versions prior to 4.9.7 Description An issue exists where the plugin fails to perform a capability check in an AJAX action and does not properly validate a user-controlled path used in a file inclusion. This allows users with a...