2026

Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat_issues_top.pl script (sub calcu

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts t

The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 vi

The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all vers

The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable

The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capabil

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to S

The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all version

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to I

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to A

The PeproDev Branches Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and i

The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a

The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email addr

The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound paym

The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order

The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being update

The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when totals are recalculate

The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before de

The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute b

The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incom

The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capab

A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowin

The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on a

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may

The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its payment webhook, acce

The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin b

The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment

The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outpu

The Pricing Table WordPress plugin before 2.1.5 does not validate the scheme of a user-supplied link value in one of it

The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template bo

The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before

The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated reque

Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers

Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. Authenticated remote attackers can bypa

Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers

The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restric

The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two

The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers t

The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-cont

The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to

The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowin

The GamiPress WordPress plugin before 8.0.6 does not perform a capability check or ownership verification on one of its

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration v

The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization be

The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of

The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value

The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target lis

The Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon markup stored in its form blocks before i

The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks