CVE-2026-66663

Unauthenticated Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...

CVE-2026-65569

Subscriber SQL Injection in WP Job Portal = 2.5.6 versions...

CVE-2026-65520 WordPress WP OAuth Server plugin <= 6.2.0 - SQL Injection vulnerability

Unauthenticated SQL Injection in WP OAuth Server = 6.2.0 versions...

CVE-2026-61982 WordPress SiteGuard WP Plugin plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in SiteGuard WP Plugin = 1.8.6 versions...

PT-2026-68579

Name of the Vulnerable Software and Affected Versions WP Data Access versions prior to 5.5.80 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. Recommendation...

CVE-2026-15149: Improper Input Validation

The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total are non-negative when placing a booking, and relies on client-controlled cart data, allowing unauthenticated users to create confirmed reservations for free or at an arbitrarily...

CVE-2026-66663: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...

CVE-2026-66451: Authentication Bypass Using an Alternate Path or Channel

Unauthenticated Broken Authentication in WP Event SOlution = 4.1.9 versions...

CVE-2026-65520: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in WP OAuth Server = 6.2.0 versions...

CVE-2026-61982: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in SiteGuard WP Plugin = 1.8.6 versions...

CVE-2026-16734: Missing Authorization

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a...

PT-2026-68558

Name of the Vulnerable Software and Affected Versions WP Job Portal versions prior to 2.5.7 Description An issue exists in the WP Job Portal plugin for WordPress due to insufficient escaping of user-supplied parameters and a lack of proper preparation of SQL queries. This allows authenticated...

CVE-2026-65569: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in WP Job Portal = 2.5.6 versions...

PT-2026-68531

Name of the Vulnerable Software and Affected Versions SiteGuard WP Plugin versions prior to 1.8.7 Description Stored Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which...

PT-2026-68639

Name of the Vulnerable Software and Affected Versions WP Travel Engine versions prior to 6.8.2 Description The plugin fails to verify if incoming PayPal payment notifications were sent to the configured merchant account or if the paid amount matches the order total before marking a booking as pai...

CVE-2026-16636: Improper Neutralization of Input During Web Page Generation

The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name to.name in Email Logs in all versions up to, and including, 2.2.95 due to insufficient input...

CVE-2026-12501: Insufficient Verification of Data Authenticity

The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent to the site's configured merchant account, nor that the paid amount matches the order total, before marking a booking as paid, allowing unauthenticated attackers to mark bookin...

CVE-2026-15152: Insufficient Verification of Data Authenticity

The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without a...

PT-2026-68652

Name of the Vulnerable Software and Affected Versions WP Hotel Booking WordPress plugin versions prior to 2.3.2 Description An issue exists where the plugin fails to verify if a payment notification is linked to the site's own merchant account or if the paid amount aligns with the booking total...

PT-2026-68373

Name of the Vulnerable Software and Affected Versions FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider versions prior to 2.2.96 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored...