CVE-2026-15072

The CVE-2026-15072 entry concerns the KiviCare – Clinic & Patient Management System (EHR) WordPress plugin, affected up to version 4.5.0. It describes a SQL Injection in the KCQueryBuilder via the 'orderby' parameter due to insufficient escaping and inadequate query preparation. Exploitation requ...

CVE-2026-15338

CVE-2026-15338 concerns the LA-Studio Element Kit for Elementor plugin for WordPress. Affected: all versions up to 1.6.1. Issue: Local File Inclusion via the get_type_template function in the progress_type widget setting. Exploitation requires authenticated access at contributor level or higher, ...

CVE-2026-12426

The CVE-2026-12426 affects the WordPress plugin Members – Membership & User Role Editor, up to version 3.2.22. The vulnerability enables unauthenticated attackers to perform sensitive information exposure via the REST API pagination side channel, using the members_filter_protected_posts_for_rest ...

CVE-2026-3367

The CVE-2026-3367 entry concerns the WordPress plugin Lockme Cal­endars Integration (

CVE-2026-13262

CVE-2026-13262 affects the Majestic Support WordPress plugin (up to version 1.1.9). The issue is a generic SQL injection in the val parameter caused by insufficient escaping and lack of proper query preparation, allowing an attacker to append additional SQL to existing queries and potentially ext...

CVE-2026-10628

The CVE concerns the WordPress plugin Points and Rewards for WooCommerce (affected: all versions up to 2.10.0). It describes an authorization bypass in which authenticated users with subscriber-level access and above can perform arbitrary modifications via multiple AJAX actions. Core implications...

CVE-2026-15073

KiviCare – Clinic & Patient Management System (WordPress)

CVE-2026-5743

The CVE concerns the SimpLy Gallery Block & Lightbox WordPress plugin. A stored XSS vulnerability exists through the sliderMaxHeight block attribute in all versions up to and including 3.3.3.2, caused by insufficient input sanitization and output escaping in pgc_sgb_render_callback(). The root ca...

CVE-2026-8678

The CVE-2026-8678 entry concerns the WordPress MyParcel plugin and its versions up to 4.25.1. Affected component: the MyParcel plugin (WordPress). Root cause: missing authorization verification for certain AJAX actions (wcmp_get_shipment_options and wcmp_save_shipment_options). Impact: authentica...

CVE-2026-11426

CVE-2026-11426 concerns the UnderConstructionPage PRO plugin for WordPress. The vulnerability, present in all versions up to 5.76, allows Arbitrary File Read via the template_thumbnail parameter, where local file paths are copied into a publicly accessible uploads file. This permits authenticated...

CVE-2026-13756

Technical details are not publicly available in the provided documents for CVE-2026-13756. Monitor for updates.

CVE-2026-28618

Technical details for CVE-2026-28618 are not publicly provided in the supplied documents. No product/vendor/component/version or impact info is available here; monitor for updates.

CVE-2026-28603

Technical details for CVE-2026-28603 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-28583

Technical details for CVE-2026-28583 are not publicly available in the provided documents. The entry appears reserved with no disclosed impact, affected products, or remediation. Monitor for updates as additional information is released.

CVE-2026-28642

Technical details for CVE-2026-28642 are not provided in the connected documents. The initial description is reserved/no details. Monitor for updates and additional disclosures from the issuing organization as they become available.

CVE-2026-28634

Technical details for CVE-2026-28634 are not publicly available in the provided documents. The connected PT security notes summarize patch activity but do not disclose affected product specifics, root cause, or remediation for this CVE. Monitor for updates.

CVE-2026-0084

Technical details for CVE-2026-0084 are not publicly available in the provided documents. Monitor for updates from the reserving entity once details are disclosed.

CVE-2026-28631

Technical details for CVE-2026-28631 are not provided in the initial or connected documents. The sources list CVE numbers and patch notes but give no specifics on affected product/version, root cause, impact, or remediation.

CVE-2026-28590

Technical details for CVE-2026-28590 are not provided in the provided documents. The connected PT-Security entries only reference general July 2026 patch activity and list CVEs without specifics. Monitor for updates and official advisories for concrete details.

CVE-2026-28584

CVE-2026-28584 is present in the connected documents as part of the July 2026 Google Android patches, categorized under High severity in the Android security bulletin. The PT Security entries repeatedly reference July 2026 CVE patch batches and list CVE-2026-28584 among the High risk CVEs in that...