PT-2026-86398

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issue id parameter to the public deploy-board comment endpoint...

PT-2026-86413

AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global...

PT-2026-86414

WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode...

PT-2026-86351

🚨 CVE-2026-84899 The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline script, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected pos...

PT-2026-86334

🚨 CVE-2026-78362 The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin before 3.0.3 and take ov...

PT-2026-86468

Name of the Vulnerable Software and Affected Versions Tenda HG10 affected versions not specified Description A remote buffer overflow exists in the formURL function within the /boaform/admin/formURL endpoint. This issue occurs when the Keywd/urlFQDN argument is manipulated, potentially allowing a...

PT-2026-86326

🚨 CVE-2026-19861 The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it in the HTML notification emails it sends, allowing unauthenticated users to inject arbitrary HTML into messages delivere...

PT-2026-86340

🚨 CVE-2026-82304 The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users. 🎖@cveNotify...

PT-2026-86324

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key in all versions up to, and including, 3.15.1 due to insufficient input sanitization and output escaping. Thi...

PT-2026-86306

Name of the Vulnerable Software and Affected Versions PCRE2 versions prior to 10.48 Description An out-of-bounds write occurs in the pcre2 dfa match function due to a missing size check when reusing a cached workspace block within a recursive Deterministic Finite Automaton DFA matching workspace...

PT-2026-86362

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'formDataid' Parameter in all versions up to, and including, 2.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2026-86337

🚨 CVE-2026-81404 The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who are tricked into submitting a crafted...

PT-2026-86313

The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due to the tml ms signup handler function's gimmeanotherblog branch failing to enforce the network's active signup registration policy,...

PT-2026-86325

🚨 CVE-2026-19858 The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, includin...

PT-2026-86405

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokri account member permissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with...

PT-2026-86354

🚨 CVE-2026-84927 The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting...

PT-2026-86392

Name of the Vulnerable Software and Affected Versions Cua computer-server versions prior to 0.3.42 Description Authentication is bypassed when the CONTAINER NAME environment variable is unset, as the server binds to all interfaces by default. This allows unauthenticated attackers to execute...

PT-2026-86352

🚨 CVE-2026-84901 The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and dele...

PT-2026-86457

🚨 CVE-2026-86148 A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is possible to launch the attack...

PT-2026-86440

Name of the Vulnerable Software and Affected Versions libpcap versions prior to 1.10.7 Description The BPF interpreter fails to validate the register index when loading or storing values from or to a scratch memory register. While the index is an unsigned 32-bit integer that should not exceed 15,...

PT-2026-86428

Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to store a value of arbitrary size in an attribute whose length constraint should bound it. Ash measures string length with Elixir's String.length/1, which counts Unicode graphemes, in the max...

PT-2026-86307

The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all versions up to, and including, 7.3.3. This is due to insufficient input sanitization when storing attribute values using only wp unslash...

PT-2026-86320

The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

PT-2026-86357

🚨 CVE-2026-84934 The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plug...

PT-2026-86302

xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking...

PT-2026-86312

Name of the Vulnerable Software and Affected Versions Hummingbird versions prior to 3.21.1 Description Remote Code Execution is possible via the log msg function in core/modules/class-page-cache.php. The page-cache debug log is written to a web-accessible PHP file that fails to maintain a...

PT-2026-86459

🚨 CVE-2026-86150 A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Such manipulation of the argument wpa passphrase leads to hard-coded credentials. The attack can be launched remotely. The exploit has been...

PT-2026-86402

Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author...

PT-2026-86335

If you run a WordPress site, you gotta stop whatever you are doing and check your dashboard immediately. So I was just looking through the Wordfence database and found a crazy vulnerability in W3 Total Cache, that huge plugin with almost a million active installs. We are talking about an...

PT-2026-86303

In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation...

PT-2026-86408

The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulk actions' function. This makes it possible for authenticated attackers, with...

PT-2026-86366

Name of the Vulnerable Software and Affected Versions ComboBlocks versions 2.2.32 through 2.3.1 Description The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress contains an Unauthenticated Hook Injection flaw. This issue occurs through several functions within the...

PT-2026-86333

🚨 CVE-2026-78150 The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and...

PT-2026-86384

BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit readthrough function that allows authenticated users to modify other users' reading records. Attackers can exploit sequential ReadThrough IDs to overwrite arbitrary users' start dates, finish dates, progress, and...

PT-2026-86395

Name of the Vulnerable Software and Affected Versions AutoAgent affected versions not specified Description An unauthenticated remote code execution issue exists in the TCP server that binds to all interfaces. This allows an attacker to connect to the exposed communication port and execute...

PT-2026-86329

The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the et pb set video oembed thumbnail resolution function using wp remote get instead of wp safe remote get to fetch a remote image URL, which does not restrict...

PT-2026-86394

SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can connect to internal databases, execute SQL commands, enumerate schemas, and pivot into the server's...

PT-2026-86348

🚨 CVE-2026-84745 The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site,...

PT-2026-86390

Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZE ORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, acce...

PT-2026-86367

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'not found' Shortcode Attribute in all versions up to, and including, 3.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

PT-2026-86338

🚨 CVE-2026-81423 The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect visitors to an arbitrary external website, which can be leveraged for phishing. 🎖@cveNotify...

PT-2026-86383

BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create...

PT-2026-86331

The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-86343

🚨 CVE-2026-83544 The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed...

PT-2026-86360

🚨 CVE-2026-84937 The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database...

PT-2026-86328

The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the image src attribute of the et pb video slider item shortcode in all versions up to, and including, 4.27.6. This is due to the image src field not being included in the $url options whitelist which only...

PT-2026-86363

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability checks and nonce verification on multiple AJAX actions including wcap save connector settings, wcap send manual email,...

PT-2026-86327

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce plugin for WordPress versions prior to 2.12.2 Description PHP Object Injection occurs due to the deserialization of untrusted input within the Telecom EDY payment callback usces action acting transaction. Unauthenticated...

PT-2026-86417

SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound to inaccessible documents, exposing private database contents without authorization...

PT-2026-86355

🚨 CVE-2026-84930 The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the...