CVE-2026-65569: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in WP Job Portal = 2.5.6 versions...

PT-2026-68531

Name of the Vulnerable Software and Affected Versions SiteGuard WP Plugin versions prior to 1.8.7 Description Stored Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which...

PT-2026-68639

Name of the Vulnerable Software and Affected Versions WP Travel Engine versions prior to 6.8.2 Description The plugin fails to verify if incoming PayPal payment notifications were sent to the configured merchant account or if the paid amount matches the order total before marking a booking as pai...

CVE-2026-16636: Improper Neutralization of Input During Web Page Generation

The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name to.name in Email Logs in all versions up to, and including, 2.2.95 due to insufficient input...

CVE-2026-12501: Insufficient Verification of Data Authenticity

The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent to the site's configured merchant account, nor that the paid amount matches the order total, before marking a booking as paid, allowing unauthenticated attackers to mark bookin...

CVE-2026-15152: Insufficient Verification of Data Authenticity

The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without a...

PT-2026-68652

Name of the Vulnerable Software and Affected Versions WP Hotel Booking WordPress plugin versions prior to 2.3.2 Description An issue exists where the plugin fails to verify if a payment notification is linked to the site's own merchant account or if the paid amount aligns with the booking total...

PT-2026-68373

Name of the Vulnerable Software and Affected Versions FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider versions prior to 2.2.96 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored...

PT-2026-68401

Name of the Vulnerable Software and Affected Versions Stripe Payment Forms by WP Full Pay versions prior to 8.5.2 Description An issue exists where the plugin fails to verify if the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions. This allows an...

CVE-2026-18933 wp-downloadmanager - Unrestricted File Upload via Missing Extension/MIME Validation and Path Traversal

The wp-downloadmanager WordPress plugin, in version 1.68.11 also affecting the 6.9.4 release line, allows an admin-privileged user currentusercan'managedownloads' to upload arbitrary files via download-add.php with no extension or MIME-type validation of any kind - no wpcheckfiletypeandext, no...

CVE-2026-18933

The wp-downloadmanager plugin (v1.68.11, also affecting the 6.9.4 line) allows an admin user to upload arbitrary files via download-add.php without any extension/MIME validation or traversal protection. The destination path is built from unsanitized $_POST['file_upload_to'], and since the base pa...

CVE-2026-11977

The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to generic SQL Injection via the 'wpmametaboxauthorslist' parameter in all versions up to, and including, 3.9.1 due to insufficient escaping on the user supplied parameter and lack...

CVE-2026-11969: Improper Neutralization of Special Elements used in an SQL Command

The WP TripAdvisor Review Slider plugin for WordPress is vulnerable to generic SQL Injection via 'curselrevs' Parameter in all versions up to, and including, 14.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes i...

PT-2026-68015

Name of the Vulnerable Software and Affected Versions User Access Manager versions prior to 2.3.13 Description Authenticated attackers with subscriber-level access and above can perform a Second-Order SQL Injection. This occurs via the 'id' parameter of the wp ajax save-attachment-compat AJAX...

CVE-2026-16942: Improper Neutralization of Input During Web Page Generation

The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed to post unfiltered HTML, allowing users with the Author role to store JavaScript that is served unescaped at a public URL and executes for...

CVE-2026-15372: Improper Authentication

The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator...

CVE-2026-7444: Cross-Site Request Forgery (CSRF)

The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missing or incorrect nonce validation on the processbulkaction function of MWTSAStatsTable. This makes it possible for unauthenticated attacker...

PT-2026-68119

Name of the Vulnerable Software and Affected Versions wp-downloadmanager versions 1.68.11 through 1.69.0 wp-downloadmanager versions 6.9.4 through 6.9.4 Description An admin-privileged user with manage downloads capabilities can upload arbitrary files through the 'download-add.php' endpoint. The...

PT-2026-68019

Name of the Vulnerable Software and Affected Versions Super Progressive Web Apps versions prior to 2.2.44 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. The superpwa settingsoffline message txt setting is stored without sanitization and...

PT-2026-68060

Name of the Vulnerable Software and Affected Versions WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars versions prior to 3.9.2 Description This issue is a generic SQL Injection, which occurs when an application fails to properly sanitize user input, allowing an attack...