PT-2026-63801

Unauthenticated Cross Site Request Forgery CSRF in WP Accessibility Helper WAH = 0.6.6 versions...

CVE-2026-65512: Cross-Site Request Forgery (CSRF)

Cross-Site request forgery CSRF vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery. This issue affects WP Activity Log: through 5.6.4; WP Activity Log Premium: through 5.6.4...

CVE-2026-24537: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in WP Accessibility Helper WAH = 0.6.6 versions...

PT-2026-63820

Subscriber Broken Access Control in WP Booking System 5.12.8.1 versions...

CVE-2026-15786: Improper Limitation of a Pathname to a Restricted Directory

The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.8.6.6 via the 'imploded' parameter parameter. This makes it possible for authenticated attackers, with...

CVE-2026-59522: Missing Authorization

Subscriber Broken Access Control in WP ERP = 1.17.5 versions...

CVE-2026-57367: Missing Authorization

Subscriber Broken Access Control in WP Booking System 5.12.8.1 versions...

CVE-2026-25466: Missing Authorization

Unauthenticated Broken Access Control in WP Go Maps = 10.1.04 versions...

CVE-2026-65521: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Unauthenticated Sensitive Data Exposure in WP Social Ninja = 4.3.0 versions...

CVE-2026-57767: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WP Google Maps Pro = 10.1.02 versions...

CVE-2026-65475: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Chill Modula Image Gallery allows Stored XSS. This issue affects Modula Image Gallery: from 2.14.25 through 2.14.30...

CVE-2026-9066: Improper Neutralization of Input During Web Page Generation

The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress...

CVE-2026-27418: Missing Authorization

Unauthenticated Broken Access Control in WP Fast Total Search = 1.81.282 versions...

CVE-2026-59541: Incorrect Privilege Assignment

Subscriber Privilege Escalation in WP BASE Booking = 6.3.1 versions...

CVE-2026-57808: Missing Authorization

Subscriber Arbitrary Content Deletion in WP EasyPay = 4.5.0 versions...

PT-2026-63575

The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress...

CVE-2025-68081: Improper Neutralization of Input During Web Page Generation

Administrator Cross Site Scripting XSS in WP-Polls = 2.77.3 versions...

CVE-2026-9635: Improper Neutralization of Input During Web Page Generation

The WP Shortcode by MyThemeShop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of the tab shortcode in versions up to, and including, 1.4.17. This is due to insufficient input sanitization and output escaping in the mtstabs function, which outputs the...

WordPress WP Fast Total Search plugin <= 1.81.282 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Que Thanh Tuan in WordPress Plugin WP Fast Total Search versions = 1.81.282...

CVE-2026-15802

The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'deletelocationsbackupfilecallback' function in all versions up to, and including, 4.9. This makes it possible for authenticated attackers, with subscriber-level access...