---METADATA---
VENDOR: WordPress
PRODUCT: Offload, AI & Optimize with Cloudflare Images
AFFECTED_VERSIONS: <= 1
---END_METADATA---

Description Summary:
The Offload, AI & Optimize with Cloudflare Images plugin for WordPress is susceptible to Remote Code Execution due to insufficient input validation.

Executive Summary:
A critical Remote Code Execution vulnerability in the Offload, AI & Optimize with Cloudflare Images plugin allows attackers to gain full control over the WordPress server.

Vulnerability Details

CVE-ID: CVE-2026-9860

Affected Software: WordPress Offload, AI & Optimize with Cloudflare Images Plugin

Affected Versions: <= 1

Vulnerability: The plugin fails to validate user input correctly, allowing for the execution of arbitrary code on the underlying server. This vulnerability effectively permits an attacker to bypass standard WordPress application controls and execute commands at the web server's privilege level.

Business Impact

With a CVSS score of 8.8, this represents a critical threat. Remote Code Execution (RCE) is one of the most severe vulnerability types, as it allows attackers to install persistent backdoors, deploy ransomware, or exfiltrate the entirety of the application's environment.

Remediation Plan

Immediate Action: Update the plugin to the latest version immediately or remove it from the environment if no patch is available.

Proactive Monitoring: Perform integrity checks on the web server files and monitor for unusual outbound network traffic indicating a reverse shell or command-and-control communication.

Compensating Controls: Implement strict file permission policies and disable the ability for the web server to execute commands in sensitive directories.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The risk posed by RCE vulnerabilities is extreme. Organizations utilizing this plugin must take immediate action to patch or remove the affected software to prevent a full-scale compromise of their web infrastructure.

---METADATA---
VENDOR: WordPress
PRODUCT: Database for Contact Form 7, WPforms, Elementor forms plugin
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient path validation in the view_page function.

Executive Summary:
A critical arbitrary file deletion vulnerability exists in the Database for Contact Form 7, WPforms, Elementor forms plugin, posing a significant risk of service disruption or site compromise.

Vulnerability Details

CVE-ID: CVE-2026-9843

Affected Software: WordPress Database for Contact Form 7, WPforms, Elementor forms plugin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin fails to adequately sanitize file paths within the view_page function, allowing an authenticated attacker to delete arbitrary files on the server. The required authentication level implies that an attacker must possess valid credentials to trigger the vulnerable function.

Business Impact

Successful exploitation of this vulnerability can lead to the deletion of critical system or application files, resulting in severe service downtime and potential loss of data integrity. With a CVSS score of 8.1, this high-severity flaw represents a substantial risk to business continuity and operational security, particularly if the deleted files are essential for site functionality.

Remediation Plan

Immediate Action: Update the plugin to the latest version provided by the vendor to patch the path validation flaw.

Proactive Monitoring: Audit web server logs for suspicious requests directed at the view_page function or unusual file deletion patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and suspicious parameter inputs.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the severity of the vulnerability, administrators must prioritize updating the affected plugin immediately. If an update is not currently available, consider disabling the plugin entirely to mitigate the risk of unauthorized file deletion until a vendor-supplied patch is implemented.

---METADATA---
VENDOR: printcart
PRODUCT: Printcart Web to Print Product Designer for WooCommerce
AFFECTED_VERSIONS: Up to and including 2.5.2
---END_METADATA---

Description Summary:
The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to unauthenticated arbitrary file deletion via improper path validation and nonce exposure.

Executive Summary:
A critical arbitrary file deletion vulnerability in the Printcart WordPress plugin allows unauthenticated attackers to execute unauthorized file operations, potentially leading to remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-9725

Affected Software: printcart Printcart Web to Print Product Designer for WooCommerce

Affected Versions: Up to and including 2.5.2

Vulnerability: The plugin fails to perform adequate path validation on the 'nbd_item_key' parameter and fails to properly secure the nonce required for the nbd_save_customer_design action, allowing unauthenticated attackers to delete arbitrary files.

Business Impact

This vulnerability is rated 9.1 (Critical) as it facilitates arbitrary file deletion, which can be chained to achieve Remote Code Execution (RCE). The impact includes complete site compromise, data loss, and potential total loss of control over the WordPress server environment, posing a severe threat to business continuity.

Remediation Plan

Immediate Action: Update the Printcart Web to Print Product Designer for WooCommerce plugin to the latest version immediately.

Proactive Monitoring: Monitor server filesystem integrity and review web server logs for suspicious POST requests targeting the plugin's AJAX endpoints.

Compensating Controls: Utilize a Web Application Firewall (WAF) to block requests containing directory traversal sequences or unauthorized attempts to access sensitive plugin functions.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly dangerous because it allows unauthenticated attackers to perform destructive actions on the server. Site administrators must update the plugin immediately to the latest patched version to prevent potential RCE and complete site takeover.

---METADATA---
VENDOR: EventON
PRODUCT: EventON (Pro) - WordPress Virtual Event Calendar Plugin
AFFECTED_VERSIONS: Up to and including 5.0.11
---END_METADATA---

Description Summary:
The EventON WordPress plugin is vulnerable to unauthenticated SQL injection via the search parameter due to insufficient input escaping and lack of parameterized queries.

Executive Summary:
A critical SQL injection vulnerability in the EventON plugin allows unauthenticated attackers to extract sensitive database information, posing a severe risk to data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-9711

Affected Software: EventON EventON (Pro)

Affected Versions: Up to and including 5.0.11

Vulnerability: The vulnerability exists due to improper handling of the WordPress 'search' parameter. Unauthenticated attackers can inject malicious SQL commands into existing queries if the "Enable additional search queries" setting is active, allowing for unauthorized data extraction.

Business Impact

With a CVSS score of 9.8, this vulnerability represents an extreme risk of data breach. Successful exploitation allows unauthorized access to the underlying database, potentially exposing sensitive customer data, administrative credentials, or proprietary information, leading to severe regulatory and financial consequences.

Remediation Plan

Immediate Action: Update the EventON plugin to the latest version immediately to resolve the SQL injection flaw.

Proactive Monitoring: Monitor database query logs for anomalous patterns or injection-style characters (e.g., ', --, UNION) associated with the search function.

Compensating Controls: Utilize a Web Application Firewall (WAF) with SQL injection protection rules to inspect and filter malicious search queries before they reach the application.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly critical and requires immediate attention to prevent unauthorized access to sensitive database contents. Organizations utilizing EventON must apply the latest vendor update as soon as possible to mitigate the risk of data exfiltration.

---METADATA---
VENDOR: WordPress
PRODUCT: Recover Exit For WooCommerce Plugin
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The "Recover Exit For WooCommerce" WordPress plugin is vulnerable to Local File Inclusion (LFI), which could allow attackers to access sensitive server files.

Executive Summary:
A Local File Inclusion vulnerability in the Recover Exit For WooCommerce plugin for WordPress exposes the host server to potential information disclosure and unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-9662

Affected Software: WordPress Recover Exit For WooCommerce Plugin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin is susceptible to Local File Inclusion (LFI), allowing an attacker to include files on the server that should not be accessible. This vulnerability typically allows an unauthenticated attacker to read sensitive configuration files or perform path traversal.

Business Impact

An LFI vulnerability is critical as it can lead to the exposure of configuration files (e.g., wp-config.php), database credentials, or system information. Given the CVSS score of 8.1, the risk of total site compromise is high, necessitating immediate action to secure the WordPress installation.

Remediation Plan

Immediate Action: Update the "Recover Exit For WooCommerce" plugin to the latest available version or remove the plugin if it is not strictly required.

Proactive Monitoring: Review WordPress access logs for path traversal patterns (e.g., ../../) and unexpected file access attempts.

Compensating Controls: Utilize a security plugin or WAF with LFI protection rules to block malicious input patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Plugin-based vulnerabilities are a common attack vector for WordPress sites. Administrators must update the affected plugin immediately or disable it to prevent attackers from leveraging this LFI flaw to gain unauthorized access to the underlying server.

---METADATA---
VENDOR: GutenBee
PRODUCT: GutenBee – Gutenberg Blocks plugin
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: patch, technical_details
---END_METADATA---

Description Summary:
The GutenBee – Gutenberg Blocks plugin for WordPress is vulnerable to arbitrary file upload, potentially allowing unauthenticated or low-privileged attackers to execute malicious code.

Executive Summary:
An arbitrary file upload vulnerability in the GutenBee – Gutenberg Blocks plugin for WordPress could allow remote attackers to achieve unauthorized code execution.

Vulnerability Details

CVE-ID: CVE-2026-9227

Affected Software: GutenBee – Gutenberg Blocks plugin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin suffers from an arbitrary file upload vulnerability, which typically allows an attacker to upload malicious files to the web server. Depending on the server configuration, this can lead to remote code execution; authentication requirements are not explicitly defined, but such flaws often bypass standard access controls.

Business Impact

An arbitrary file upload vulnerability is critical because it provides a direct vector for attackers to gain a foothold on the web server. This could lead to a full compromise of the WordPress site, resulting in data theft, site defacement, or the server being utilized for further attacks against the corporate network. The CVSS score of 8.8 underscores the severity of this risk.

Remediation Plan

Immediate Action: Update the GutenBee – Gutenberg Blocks plugin to the latest available version provided by the vendor.

Proactive Monitoring: Review web server access logs for suspicious file uploads or requests to unfamiliar files within the plugin directories.

Compensating Controls: Implement a Web Application Firewall (WAF) to block unauthorized file upload attempts and restrict file execution permissions in the uploads directory.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Plugin vulnerabilities are a frequent target for automated exploitation. Administrators should immediately update the GutenBee plugin and verify that no unauthorized files have been uploaded to the environment. If an update is not immediately available, consider disabling the plugin until a secure version is released.

---METADATA---
VENDOR: WordPress
PRODUCT: Easy Elements for Elementor – Addons & Website Templates
AFFECTED_VERSIONS: All versions up to, and including, 1
CONFIDENCE: high
MISSING: patch, technical_details
---END_METADATA---

Description Summary:
The Easy Elements for Elementor plugin for WordPress is susceptible to a privilege escalation vulnerability in all versions up to and including 1.

Executive Summary:
A privilege escalation vulnerability in the Easy Elements for Elementor plugin could allow unauthorized users to gain elevated administrative rights within a WordPress site.

Vulnerability Details

CVE-ID: CVE-2026-9018

Affected Software: WordPress Easy Elements for Elementor – Addons & Website Templates

Affected Versions: All versions up to, and including, 1

Vulnerability: This is a privilege escalation vulnerability, which typically suggests an insufficient capability check on sensitive functions. Depending on the implementation, this may allow an authenticated user with low-level privileges to perform administrative actions or escalate their account permissions.

Business Impact

A CVSS score of 8.8 indicates a high-severity threat. If successfully exploited, an attacker could gain full administrative control over the WordPress installation, leading to site defacement, the injection of malicious scripts, or the compromise of user databases and sensitive customer information.

Remediation Plan

Immediate Action: Update the "Easy Elements for Elementor" plugin to the latest available version immediately; if no update is available, deactivate and remove the plugin.

Proactive Monitoring: Review WordPress user account activity logs for unauthorized privilege changes or the creation of new administrative accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block common privilege escalation patterns in WordPress plugins.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Privilege escalation vulnerabilities in content management systems are high-value targets for attackers looking to gain persistent access. Administrators must audit all installed WordPress plugins and immediately remove any that are known to be vulnerable or are no longer actively maintained.

---METADATA---
VENDOR: WordPress
PRODUCT: Boost plugin
AFFECTED_VERSIONS: See vendor advisory for affected versions
CONFIDENCE: medium
MISSING: patch, exploit_status
---END_METADATA---

Description Summary:
The Boost plugin for WordPress is susceptible to time-based SQL injection via the 'current_url' and 'user_name' parameters.

Executive Summary:
The Boost plugin for WordPress is vulnerable to time-based SQL injection, potentially allowing unauthorized database access and data exfiltration.

Vulnerability Details

CVE-ID: CVE-2026-9010

Affected Software: WordPress Boost plugin

Affected Versions: See vendor advisory for affected versions

Vulnerability: This is a time-based SQL Injection vulnerability occurring within the Boost plugin. The vulnerability allows an attacker to manipulate the 'current_url' and 'user_name' parameters to execute arbitrary SQL commands against the underlying database.

Business Impact

A successful exploit allows an attacker to read, modify, or delete sensitive information stored in the WordPress database, leading to potential data breaches or account takeovers. With a CVSS score of 7.5, this high-severity flaw poses a significant risk to the confidentiality and integrity of site data, which may result in severe reputational damage and regulatory non-compliance.

Remediation Plan

Immediate Action: Audit the WordPress environment and update the Boost plugin to the latest available version provided by the vendor.

Proactive Monitoring: Monitor database query logs for unusual time-based delays or patterns indicative of SQL injection attempts targeting the specified parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block malicious SQL injection payloads targeting WordPress plugins.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score and the nature of SQL injection, administrators must prioritize identifying if this plugin is currently in use. If identified, immediate updates or removal of the plugin is required to mitigate the risk of unauthorized database access.

---METADATA---
VENDOR: Crawlomatic
PRODUCT: Multipage Scraper Post Generator (WordPress Plugin)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: patch, technical_details
---END_METADATA---

Description Summary:
The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is susceptible to Remote Code Execution (RCE) due to improper input handling.

Executive Summary:
The Crawlomatic Multipage Scraper Post Generator plugin for WordPress contains a critical Remote Code Execution vulnerability that could allow an attacker to gain full control of the affected site.

Vulnerability Details

CVE-ID: CVE-2026-9009

Affected Software: Crawlomatic Multipage Scraper Post Generator

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a Remote Code Execution vulnerability. While authentication requirements are not explicitly defined, RCE flaws in WordPress plugins typically bypass standard access controls, allowing unauthenticated or low-privileged attackers to execute arbitrary code on the server.

Business Impact

Successful exploitation allows an attacker to execute arbitrary commands on the underlying web server, potentially leading to full site compromise, data exfiltration, or the deployment of ransomware. Given the CVSS score of 8.8, this vulnerability poses a severe risk to the integrity and availability of the WordPress environment.

Remediation Plan

Immediate Action: Check the WordPress plugin repository for the latest version and update the Crawlomatic plugin immediately. If a patch is unavailable, deactivate and remove the plugin until a secure version is released.

Proactive Monitoring: Review web server access logs for suspicious POST requests or attempts to execute system-level commands via the plugin’s directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common RCE payloads and suspicious execution patterns targeting WordPress plugins.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a critical threat due to the potential for complete system compromise. Administrators must prioritize updating or removing the vulnerable plugin immediately to eliminate the attack surface and prevent unauthorized code execution.

---METADATA---
VENDOR: WordPress
PRODUCT: WP MAPS PRO Plugin
AFFECTED_VERSIONS: Before 6.1.1
---END_METADATA---

Description Summary:
The WP MAPS PRO WordPress plugin allows unauthenticated attackers to create administrator accounts via an improperly secured AJAX action.

Executive Summary:
This critical vulnerability allows any unauthenticated attacker to create a new administrator account, leading to full site takeover.

Vulnerability Details

CVE-ID: CVE-2026-8935

Affected Software: WordPress Plugin: WP MAPS PRO

Affected Versions: Before 6.1.1

Vulnerability: The plugin registers an unauthenticated AJAX action that, when provided with a publicly accessible nonce, allows the creation of a new administrator account and provides a login URL for immediate access.

Business Impact

With a CVSS score of 9.8, this vulnerability grants an attacker full administrative control over the WordPress instance. This allows for total data exposure, site defacement, and the installation of malicious plugins or backdoors, causing significant reputational and operational damage.

Remediation Plan

Immediate Action: Update the WP MAPS PRO plugin to version 6.1.1 or later immediately.

Proactive Monitoring: Review the user list in the WordPress dashboard for any unauthorized administrator accounts created recently.

Compensating Controls: Restrict access to the WordPress admin panel via IP whitelisting or multi-factor authentication (MFA) to prevent unauthorized use of the created accounts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, the ease of exploitation makes it a high-priority target.

Analyst Recommendation

The ability to create an administrative account without authentication is a critical security failure. Administrators must update the plugin immediately and audit existing user accounts for signs of compromise.

---METADATA---
VENDOR: WordPress
PRODUCT: Contest Gallery Plugin
AFFECTED_VERSIONS: Up to, and including, 28
CONFIDENCE: high
MISSING: patch, exploit_status
---END_METADATA---

Description Summary:
The Contest Gallery plugin for WordPress is vulnerable to SQL injection via the 'form_input' parameter.

Executive Summary:
An SQL injection vulnerability in the Contest Gallery plugin for WordPress allows unauthenticated attackers to execute arbitrary database queries and potentially compromise site data.

Vulnerability Details

CVE-ID: CVE-2026-8912

Affected Software: WordPress Contest Gallery Plugin

Affected Versions: Up to, and including, 28

Vulnerability: This is an SQL injection vulnerability located in the 'form_input' parameter, which fails to properly sanitize user-supplied input. This flaw is exploitable by unauthenticated attackers, allowing them to manipulate database queries directly.

Business Impact

Successful exploitation can result in unauthorized access to the WordPress database, potentially leading to data theft, modification, or administrative account takeover. With a CVSS score of 7.5, this vulnerability represents a high risk to the confidentiality and integrity of the entire web application.

Remediation Plan

Immediate Action: Update the Contest Gallery plugin to the latest available version provided by the developer. If no patch is available, deactivate and remove the plugin immediately until a secure version is released.

Proactive Monitoring: Examine server and database logs for suspicious SQL syntax, such as "UNION SELECT" or other common injection patterns, directed toward the plugin.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns to provide virtual patching.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

SQL injection is a critical vulnerability that can lead to total site compromise. Administrators should audit all active plugins and ensure that any component identified as vulnerable is updated or removed from the production environment immediately to mitigate exposure.

---METADATA---
VENDOR: WPCode
PRODUCT: Code Manager Plugin
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The WPCode - Insert Headers and Footers + Custom Code Snippets plugin for WordPress is vulnerable to Remote Code Execution.

Executive Summary:
A critical Remote Code Execution vulnerability in the WPCode WordPress plugin allows unauthenticated or low-privileged attackers to gain full control over the affected site.

Vulnerability Details

CVE-ID: CVE-2026-8832

Affected Software: WPCode Code Manager Plugin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin is susceptible to Remote Code Execution (RCE), which allows an attacker to execute arbitrary code on the underlying server. This vulnerability typically stems from improper input validation in code snippet management functions.

Business Impact

With a CVSS score of 8.8, this vulnerability represents an critical risk. Successful exploitation grants an attacker complete control over the WordPress site, enabling data theft, site defacement, and the deployment of malware to end-users.

Remediation Plan

Immediate Action: Update the WPCode plugin to the latest available version immediately.

Proactive Monitoring: Review server and WordPress activity logs for signs of unauthorized file modifications or suspicious code execution.

Compensating Controls: If an update is not immediately possible, disable the plugin and remove any unauthorized code snippets found in the administrative dashboard.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of an RCE vulnerability cannot be overstated. All administrators using the WPCode plugin must update to the latest version immediately to prevent total site compromise and potential lateral movement within the hosting environment.

---METADATA---
VENDOR: WordPress
PRODUCT: Advanced Custom Fields: Extended Plugin
AFFECTED_VERSIONS: all versions up to and including 0.9.2.5
---END_METADATA---

Description Summary:
The Advanced Custom Fields: Extended plugin for WordPress contains a validation bypass vulnerability that allows unauthenticated attackers to create new administrator accounts.

Executive Summary:
A critical privilege escalation vulnerability in the Advanced Custom Fields: Extended plugin allows unauthenticated attackers to create unauthorized administrator accounts on vulnerable WordPress sites.

Vulnerability Details

CVE-ID: CVE-2026-8809

Affected Software: WordPress Advanced Custom Fields: Extended Plugin

Affected Versions: all versions up to and including 0.9.2.5

Vulnerability: This is a privilege escalation vulnerability caused by a validation bypass in the after_validate_save_post() function. The plugin fails to verify the integrity of the _acf_post_id parameter, allowing an attacker to suppress validation errors and force the system to process a user registration with an arbitrary role, such as 'administrator'.

Business Impact

With a CVSS score of 9.8, this is a critical vulnerability. The ability for an unauthenticated user to create a new administrator account grants the attacker total control over the site. This could lead to massive data breaches, installation of backdoors, and complete compromise of the site's server environment.

Remediation Plan

Immediate Action: Update the "Advanced Custom Fields: Extended" plugin to the latest version immediately.

Proactive Monitoring: Audit the WordPress user database for newly created accounts or accounts with unexpected administrator privileges.

Compensating Controls: Use a Web Application Firewall (WAF) to block requests that contain suspicious _acf_post_id parameters or that target the specific form submission endpoints used by the plugin.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, the high severity and relative ease of exploitation require immediate attention to prevent unauthorized administrative account creation.

Analyst Recommendation

This vulnerability poses an extreme risk due to the potential for unauthorized privilege escalation. Administrators must update the plugin immediately and audit current user lists to ensure no malicious accounts have been created during the period the plugin was vulnerable.

---METADATA---
VENDOR: Firebase
PRODUCT: Support & Chat Management Plugin
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Firebase Support & Chat Management plugin for WordPress contains a privilege escalation vulnerability.

Executive Summary:
A critical privilege escalation vulnerability in the Firebase Support & Chat Management plugin allows unauthorized users to gain elevated administrative permissions.

Vulnerability Details

CVE-ID: CVE-2026-8787

Affected Software: Firebase Support & Chat Management Plugin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin is vulnerable to privilege escalation, which allows a lower-privileged user to gain administrative access to the WordPress site. This indicates a failure in the plugin's internal authorization logic.

Business Impact

With a CVSS score of 8.8, this vulnerability allows for complete site takeover. Once administrative privileges are obtained, an attacker can modify content, install malicious plugins, and access sensitive user information, leading to a total loss of site integrity.

Remediation Plan

Immediate Action: Immediately update the Firebase Support & Chat Management plugin to the patched version.

Proactive Monitoring: Audit existing user accounts for suspicious additions or unexpected changes in user roles.

Compensating Controls: Use a security plugin to monitor for unauthorized administrative access attempts and enforce strong password policies.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Privilege escalation vulnerabilities are extremely dangerous. Administrators must prioritize updating this plugin to prevent attackers from gaining full control of the WordPress environment.

---METADATA---
VENDOR: WordPress
PRODUCT: Login with OTP
AFFECTED_VERSIONS: Up to and including 1.6
---END_METADATA---

Description Summary:
The WordPress "Login with OTP" plugin is vulnerable to authentication bypass via brute-forcing of the 6-digit OTP, which lacks expiration and rate-limiting on the validation branch.

Executive Summary:
An authentication bypass vulnerability in the WordPress Login with OTP plugin allows unauthenticated attackers to brute-force OTPs and hijack administrative accounts.

Vulnerability Details

CVE-ID: CVE-2026-8760

Affected Software: WordPress, Login with OTP plugin

Affected Versions: Up to and including 1.6

Vulnerability: The plugin fails to enforce rate-limiting or expiration on the OTP validation branch, despite an incomplete fix for a previous CVE. This design flaw allows an unauthenticated attacker to brute-force the 900,000-value OTP space and gain unauthorized access to any user account, including administrators.

Business Impact

The ability for an unauthenticated attacker to gain full administrative access to a WordPress site poses an existential risk. A CVSS score of 9.8 confirms the severity, as this flaw could lead to complete site takeover, malicious content injection, and total loss of site control.

Remediation Plan

Immediate Action: Update the "Login with OTP" plugin to the latest version or remove the plugin if a secure version is not available.

Proactive Monitoring: Review user login logs for multiple failed attempts followed by a successful login, which may indicate brute-force activity.

Compensating Controls: Implement an additional layer of authentication or disable the plugin until a permanent patch is confirmed and applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This flaw effectively nullifies the purpose of the OTP plugin. Administrators should immediately update the plugin. If updates are not immediately available, the plugin should be disabled to prevent account takeovers, as the current implementation offers no protection against determined attackers.

---METADATA---
VENDOR: WordPress
PRODUCT: WP Maps Pro Plugin
AFFECTED_VERSIONS: Up to and including 6.1.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The WP Maps Pro plugin for WordPress contains a privilege escalation vulnerability that allows unauthenticated attackers to create new administrator accounts and gain full site control.

Executive Summary:
An unauthenticated privilege escalation vulnerability in the WP Maps Pro plugin allows attackers to achieve full administrative site takeover.

Vulnerability Details

CVE-ID: CVE-2026-8732

Affected Software: WordPress WP Maps Pro Plugin

Affected Versions: Up to and including 6.1.0

Vulnerability: The plugin registers an AJAX action with insufficient access control, relying on a publicly accessible nonce to protect sensitive functions. Unauthenticated attackers can invoke this handler to create a new administrator account and authenticate as that user via a generated login URL.

Business Impact

This vulnerability carries a CVSS score of 9.8, indicating a critical severity level. Successful exploitation results in complete site takeover, granting the attacker full control over the WordPress environment, including access to sensitive customer data, the ability to modify site content, and the potential to distribute malware to visitors.

Remediation Plan

Immediate Action: Immediately update the WP Maps Pro plugin to the latest available version provided by the vendor. If an update is not immediately available, deactivate and remove the plugin until a patch is applied.

Proactive Monitoring: Review WordPress user account logs for the creation of unexpected administrator accounts. Monitor AJAX traffic for requests to the wpgmp_temp_access_ajax action.

Compensating Controls: Implement a Web Application Firewall (WAF) to block unauthorized requests to AJAX endpoints associated with the plugin.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw—which provides an trivial path to administrative access—the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this privilege escalation flaw, immediate action is required to secure affected WordPress installations. Administrators should prioritize updating or removing the vulnerable plugin to prevent unauthorized administrative access and potential site compromise.

---METADATA---
VENDOR: Jordy Meow
PRODUCT: AI Engine – The Chatbot, AI Framework & MCP for WordPress
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: patch, technical_details
---END_METADATA---

Description Summary:
The AI Engine plugin for WordPress is susceptible to a privilege escalation vulnerability, potentially allowing unauthorized users to gain elevated administrative rights.

Executive Summary:
A privilege escalation vulnerability in the AI Engine WordPress plugin could allow unauthorized actors to compromise site integrity by escalating their user privileges.

Vulnerability Details

CVE-ID: CVE-2026-8719

Affected Software: Jordy Meow AI Engine – The Chatbot, AI Framework & MCP for WordPress

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin contains a privilege escalation flaw that may allow an authenticated user to perform actions beyond their intended authorization level. The exact technical mechanism and the required authentication level are not fully disclosed, necessitating a review of the plugin's capability checks.

Business Impact

Successful exploitation of this vulnerability could result in full administrative control over the WordPress installation. Given the CVSS score of 8.8, this represents a high-risk scenario that may lead to unauthorized data access, site defacement, or the installation of malicious software, causing significant reputational and operational damage.

Remediation Plan

Immediate Action: Audit the WordPress environment and update the AI Engine plugin to the latest available version provided by the vendor.

Proactive Monitoring: Review WordPress user account activity logs for anomalous privilege changes or unexpected administrative actions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block suspicious requests targeting plugin-specific endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this privilege escalation flaw requires immediate attention from site administrators. We strongly recommend validating the plugin version currently in production against the vendor's security advisory and applying updates without delay to prevent unauthorized administrative access.

---METADATA---
VENDOR: WordPress
PRODUCT: WP Review Slider Pro
AFFECTED_VERSIONS: up to, and including, 12.6.8
---END_METADATA---

Description Summary:
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' parameter of the wpfb_find_reviews AJAX action.

Executive Summary:
An authenticated SQL injection vulnerability in the WP Review Slider Pro plugin could allow attackers to extract sensitive data from the WordPress database.

Vulnerability Details

CVE-ID: CVE-2026-8444

Affected Software: WordPress WP Review Slider Pro

Affected Versions: up to, and including, 12.6.8

Vulnerability: This is an SQL injection vulnerability located within the 'curselrevs[]' parameter of the wpfb_find_reviews AJAX action. The flaw is exploitable by authenticated attackers with subscriber-level access or higher, who can append malicious SQL queries to the existing database operations.

Business Impact

Successful exploitation allows an attacker to bypass standard database queries to access or exfiltrate unauthorized information from the WordPress site's backend. With a CVSS score of 8.8, this high-severity vulnerability poses a significant risk to data confidentiality, potentially exposing user credentials, configurations, or personal identifiable information (PII) stored within the database.

Remediation Plan

Immediate Action: Review the vendor advisory and update the WP Review Slider Pro plugin to the latest available version immediately.

Proactive Monitoring: Monitor database query logs for unusual syntax or high volumes of queries originating from the wpfb_find_reviews action.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block malicious SQL injection patterns within incoming POST requests to AJAX endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw—specifically the ease of constructing blind exploitation oracles via the plugin's response—the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score of 8.8 and the ease with which sensitive information can be extracted, administrators must prioritize patching this plugin. If an update is not immediately available or possible, consider disabling the plugin functionality until a secure version is deployed to mitigate the risk of data compromise.

---METADATA---
VENDOR: WordPress
PRODUCT: WP Review Slider Pro
AFFECTED_VERSIONS: WP Review Slider Pro plugin for WordPress versions up to, and including, 12.6.8
---END_METADATA---

Description Summary:
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters, allowing unauthorized data extraction.

Executive Summary:
A high-severity SQL injection vulnerability in the WP Review Slider Pro plugin allows authenticated attackers with subscriber-level access to extract sensitive information from the database.

Vulnerability Details

CVE-ID: CVE-2026-8443

Affected Software: WordPress / WP Review Slider Pro

Affected Versions: Versions up to, and including, 12.6.8

Vulnerability: The vulnerability exists in the wppro_get_overall_chart_data AJAX action, where user-supplied input is improperly processed using stripslashes() before being passed to a database query. This allows an authenticated attacker to manipulate SQL queries and exfiltrate database contents.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe threat to data confidentiality. An attacker can bypass application logic to extract sensitive customer or system data, potentially leading to a complete breach of the WordPress database and significant regulatory/compliance implications.

Remediation Plan

Immediate Action: Update the WP Review Slider Pro plugin to a version greater than 12.6.8 immediately.

Proactive Monitoring: Review database query logs for suspicious patterns or unexpected syntax that may indicate SQL injection attempts.

Compensating Controls: Enable a WAF to inspect incoming AJAX requests for SQL injection signatures and restrict database permissions for the WordPress user to the minimum required level.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 16, 2026, a public exploit is available, increasing the risk of exploitation. Immediate remediation is required to prevent data theft.

Analyst Recommendation

Given the availability of a public exploit and the high severity of SQL injection, organizations using this plugin must update immediately. Failure to do so leaves the database exposed to trivial data exfiltration by any authenticated user.

---METADATA---
VENDOR: WordPress
PRODUCT: Kirki Plugin
AFFECTED_VERSIONS: 6.0.0 to 6.0.6
---END_METADATA---

Description Summary:
The Kirki plugin for WordPress is vulnerable to unauthenticated privilege escalation via an account takeover flaw in the password reset process.

Executive Summary:
An unauthenticated account takeover vulnerability in the Kirki WordPress plugin allows attackers to compromise user accounts and escalate privileges.

Vulnerability Details

CVE-ID: CVE-2026-8206

Affected Software: WordPress Kirki Plugin

Affected Versions: 6.0.0 through 6.0.6

Vulnerability: The vulnerability exists because the plugin fails to properly validate the username-to-email mapping during password reset requests, allowing an unauthenticated attacker to trigger a password reset for any registered user to an attacker-controlled email address.

Business Impact

This flaw facilitates full account takeover, which can lead to unauthorized access to sensitive site data, administrative panel control, and the potential for malicious code injection into the website. With a CVSS score of 9.8, this represents a critical risk to site integrity and user trust.

Remediation Plan

Immediate Action: Update the Kirki plugin to the latest version immediately to resolve the password reset logic error.

Proactive Monitoring: Audit user account changes and recent password reset requests for suspicious activity or unauthorized account modifications.

Compensating Controls: Disable the password reset functionality if possible, or implement a rate-limiting mechanism on the reset endpoint via a security plugin or WAF.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Account takeover vulnerabilities are frequently targeted by automated scanners. Site administrators should prioritize updating the Kirki plugin immediately to prevent unauthorized access and potential site-wide compromise.

---METADATA---
VENDOR: WordPress
PRODUCT: Infility Global Plugin
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the Infility Global WordPress plugin may allow for unauthorized actions due to insufficient input validation.

Executive Summary:
The Infility Global WordPress plugin contains a high-severity vulnerability that could allow unauthorized actors to compromise site integrity.

Vulnerability Details

CVE-ID: CVE-2026-8163

Affected Software: WordPress Infility Global Plugin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin fails to properly validate inputs or enforce capability checks, potentially allowing an attacker to execute unauthorized functions. Given the nature of WordPress plugins, this vulnerability likely requires an authenticated user with low-level privileges or could be exploited if the plugin exposes unauthenticated AJAX endpoints.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized administrative actions, data exfiltration, or complete site takeover. With a CVSS score of 8.8, this flaw poses a significant risk to organizational data integrity and service availability, potentially resulting in severe reputational damage.

Remediation Plan

Immediate Action: Update the Infility Global plugin to the latest available version provided by the vendor. If an update is unavailable, disable or remove the plugin until a secure version is released.

Proactive Monitoring: Audit WordPress user logs for suspicious activity or unauthorized plugin settings changes. Monitor web server logs for requests directed at plugin-specific API endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common exploit patterns against WordPress plugins.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should prioritize the immediate update of the Infility Global plugin. If the vendor has not released a patch, assess the business necessity of the plugin and consider removal as the most effective mitigation strategy to prevent unauthorized access.

---METADATA---
VENDOR: WordPress
PRODUCT: Vitepos
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Vitepos plugin for WordPress contains a security vulnerability that may allow unauthorized access or impact the integrity of the point-of-sale system.

Executive Summary:
A critical security flaw in the Vitepos WordPress plugin requires immediate attention to prevent potential unauthorized access and data compromise.

Vulnerability Details

CVE-ID: CVE-2026-8157

Affected Software: WordPress Vitepos

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The Vitepos plugin for WordPress contains an unspecified vulnerability that may permit unauthorized access to system functions. Given the high CVSS score, this flaw likely involves an authentication bypass or insufficient authorization check within the plugin’s core operational code.

Business Impact

A CVSS score of 8.8 marks this as a high-risk vulnerability that could facilitate unauthorized access to sensitive point-of-sale data. The potential for exploitation could lead to significant business disruption, loss of transaction integrity, and the unauthorized exposure of customer information, necessitating immediate remediation to maintain compliance and security posture.

Remediation Plan

Immediate Action: Update the Vitepos plugin to the latest version immediately to ensure all security patches are applied.

Proactive Monitoring: Review application logs for anomalous requests or unauthorized attempts to access plugin-specific endpoints.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter malicious traffic and restrict access to plugin-related administrative interfaces from untrusted networks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high severity of this vulnerability, administrators should treat this update with the highest urgency. Ensure all WordPress environments running the Vitepos plugin are patched immediately and verify that no unauthorized administrative accounts have been created as a result of this flaw.

---METADATA---
VENDOR: WordPress
PRODUCT: Frontend File Manager Plugin
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
The WordPress Frontend File Manager Plugin is susceptible to an authenticated arbitrary file deletion vulnerability in versions up to and including 23.

Executive Summary:
An authenticated arbitrary file deletion vulnerability in the WordPress Frontend File Manager Plugin could allow an attacker to disrupt service or cause data loss by removing critical files.

Vulnerability Details

CVE-ID: CVE-2026-8095

Affected Software: WordPress Frontend File Manager Plugin

Affected Versions: See vendor advisory for affected versions

Vulnerability: This is an authenticated vulnerability, meaning the attacker must first possess a valid user account on the WordPress instance. Once authenticated, the attacker can leverage the plugin's file management functions to delete arbitrary files from the server's filesystem.

Business Impact

This vulnerability allows for the deletion of critical system or application files, which could lead to site instability, denial of service, or the removal of security-sensitive configuration files. With a CVSS score of 8.1, the high severity reflects the potential for significant operational disruption and the ease with which an attacker can cause permanent damage to the web environment.

Remediation Plan

Immediate Action: Update the Frontend File Manager Plugin to the latest patched version immediately.

Proactive Monitoring: Review WordPress user account activities and audit file modification logs for unauthorized deletion events.

Compensating Controls: If a patch is unavailable, disable the plugin entirely and implement a Web Application Firewall (WAF) to block suspicious requests targeting file management endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should treat this vulnerability with urgency, especially if the site allows user registration. Removing the plugin if it is not strictly required is the safest course of action until a verified update is applied.

---METADATA---
VENDOR: Kirki
PRODUCT: Kirki – Freeform Page Builder, Website Builder & Customizer plugin
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: high
MISSING: patch, exploit_status, technical_details
---END_METADATA---

Description Summary:
The Kirki WordPress plugin is vulnerable to arbitrary file deletion due to missing capability checks and insufficient path validation in the 'downloadZIP' function.

Executive Summary:
The Kirki WordPress plugin contains an arbitrary file deletion vulnerability that could allow an unauthenticated attacker to remove critical system files.

Vulnerability Details

CVE-ID: CVE-2026-8073

Affected Software: Kirki – Freeform Page Builder, Website Builder & Customizer

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides in the downloadZIP function, which fails to perform proper capability checks or validate file paths. This allows an unauthenticated attacker to trigger file deletion operations on the hosting server.

Business Impact

This vulnerability poses a critical risk to site availability and integrity. A CVSS score of 7.5 indicates that an attacker could delete sensitive configuration files or core application components, leading to a complete denial of service or site compromise.

Remediation Plan

Immediate Action: Update the Kirki plugin to the latest available version provided by the vendor to remediate the insecure function.

Proactive Monitoring: Review file integrity logs for unauthorized deletion events and monitor WordPress error logs for suspicious activity related to plugin-specific functions.

Compensating Controls: If an update is not immediately available, consider disabling the Kirki plugin or implementing a WAF rule to block requests targeting the downloadZIP function.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Unauthorized file deletion is a severe security event that can lead to permanent data loss or total site failure. It is imperative that site administrators update the affected plugin immediately or remove it if it is not essential to the site's operation.

---METADATA---
VENDOR: CleanTalk
PRODUCT: Anti-Spam by CleanTalk plugin
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
The Anti-Spam by CleanTalk plugin for WordPress contains an undisclosed vulnerability with a CVSS score of 8.8.

Executive Summary:
A high-severity vulnerability in the Anti-Spam by CleanTalk plugin poses a risk of unauthorized access or system impact.

Vulnerability Details

CVE-ID: CVE-2026-8071

Affected Software: CleanTalk Anti-Spam by CleanTalk

Affected Versions: See vendor advisory for affected versions

Vulnerability: The plugin is subject to a high-severity security flaw; while specific technical mechanics are pending further disclosure, vulnerabilities of this nature in security plugins often involve authentication bypass or improper access control.

Business Impact

The CVSS score of 8.8 indicates a high risk of system compromise. If exploited, an attacker could potentially bypass security controls, leading to unauthorized access to the WordPress environment, potentially compromising site integrity or sensitive visitor data.

Remediation Plan

Immediate Action: Update the Anti-Spam by CleanTalk plugin to the latest available version provided by the vendor.

Proactive Monitoring: Monitor for unusual administrative activity or changes in plugin configuration files that might indicate unauthorized tampering.

Compensating Controls: Utilize a Web Application Firewall to block suspicious traffic patterns directed at common plugin file paths.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, the high CVSS score necessitates prompt attention to minimize the window of exposure.

Analyst Recommendation

Security plugins are high-value targets; therefore, this update should be treated with urgency. Please check the vendor's official release notes and apply the latest patch to ensure the continued security of your WordPress installation.

---METADATA---
VENDOR: Eupago
PRODUCT: Eupago Gateway For Woocommerce
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: patch, technical_details
---END_METADATA---

Description Summary:
A vulnerability in the Eupago Gateway For Woocommerce WordPress plugin prior to version 4 may allow for unauthorized actions, requiring an immediate update to the latest release.

Executive Summary:
The Eupago Gateway For Woocommerce WordPress plugin is vulnerable to an unspecified security flaw, necessitating an immediate update to version 4 or higher to mitigate risk.

Vulnerability Details

CVE-ID: CVE-2026-7862

Affected Software: Eupago Gateway For Woocommerce (WordPress Plugin)

Affected Versions: See vendor advisory for specific affected versions (prior to version 4)

Vulnerability: The vulnerability affects the Eupago payment gateway integration for WordPress. While specific technical details are limited, users are advised that versions prior to the patch level may be susceptible to unauthorized exploitation.

Business Impact

The CVSS score of 8.6 indicates a high risk to business operations, particularly for e-commerce platforms. Exploitation of this vulnerability could lead to the compromise of payment processing workflows, unauthorized access to financial data, or the potential for site-wide administrative compromise.

Remediation Plan

Immediate Action: Update the Eupago Gateway For Woocommerce plugin to the latest available version (4.0 or higher) immediately.

Proactive Monitoring: Review WordPress access logs for unauthorized administrative or plugin-related API calls.

Compensating Controls: If an immediate update is not possible, disable the plugin and utilize a Web Application Firewall (WAF) with updated rules to block suspicious traffic patterns targeting the plugin directory.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

WordPress administrators must treat this plugin vulnerability as a high priority. Ensure that the plugin is updated to the latest version immediately and verify that no unauthorized user accounts have been created during the window of exposure.

---METADATA---
VENDOR: DynamiApps
PRODUCT: Frontend Admin (WordPress Plugin)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: patch, technical_details
---END_METADATA---

Description Summary:
The Frontend Admin by DynamiApps plugin for WordPress contains an authorization bypass vulnerability that may allow unauthorized access to administrative functions.

Executive Summary:
The Frontend Admin by DynamiApps WordPress plugin is vulnerable to an authorization bypass, potentially allowing unauthorized users to access or modify administrative settings.

Vulnerability Details

CVE-ID: CVE-2026-7802

Affected Software: Frontend Admin by DynamiApps

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is an authorization bypass vulnerability. The flaw indicates a failure in capability checks, which may allow attackers to perform administrative actions without the required privileges.

Business Impact

Unauthorized access to administrative functions can lead to complete site takeover, unauthorized content modification, or the creation of malicious administrative accounts. With a CVSS score of 8.8, this vulnerability poses a significant risk to the security and operational integrity of the WordPress site.

Remediation Plan

Immediate Action: Update the Frontend Admin plugin to the latest version provided by DynamiApps. If no update is available, disable the plugin to prevent potential unauthorized access.

Proactive Monitoring: Audit WordPress user account activity and review administrative logs for any actions performed by unexpected or unauthorized accounts.

Compensating Controls: Implement a WAF to restrict access to administrative paths and monitor for unauthorized attempts to trigger plugin-specific administrative functions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Authorization bypass flaws are critical because they negate the intended security boundaries of the application. Administrators should immediately verify their plugin versions and ensure that the latest security patches are applied to prevent unauthorized privilege escalation.

---METADATA---
VENDOR: Ultimate Member
PRODUCT: Ultimate Member Plugin
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Ultimate Member plugin for WordPress is vulnerable to account takeover via password reset link disclosure.

Executive Summary:
A critical account takeover vulnerability in the Ultimate Member WordPress plugin allows unauthenticated attackers to compromise user accounts.

Vulnerability Details

CVE-ID: CVE-2026-7761

Affected Software: Ultimate Member Plugin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves the improper handling of password reset mechanisms, leading to the disclosure of sensitive reset links. An attacker can leverage this to perform an account takeover without requiring prior authentication.

Business Impact

The ability for an attacker to hijack user accounts, including those with administrative privileges, presents a critical threat to the entire WordPress ecosystem. With a CVSS score of 8.8, this vulnerability could lead to total site compromise, data exfiltration, and the distribution of malicious content to visitors.

Remediation Plan

Immediate Action: Update the Ultimate Member plugin to the latest available version provided by the developer.

Proactive Monitoring: Review user account modification logs and investigate any unexpected password reset requests or suspicious profile changes.

Compensating Controls: Disable the plugin temporarily if a patch is not immediately available and employ rate-limiting on reset requests via a WAF.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly severe due to its impact on user account security. Organizations using the Ultimate Member plugin must prioritize updating their installation immediately to prevent unauthorized access and potential site-wide takeover.

---METADATA---
VENDOR: WordPress
PRODUCT: Temporary Login plugin
AFFECTED_VERSIONS: up to and including 1.0.0
---END_METADATA---

Description Summary:
The Temporary Login plugin for WordPress is vulnerable to authentication bypass, allowing unauthenticated attackers to log in as any temporary user.

Executive Summary:
An unauthenticated authentication bypass vulnerability in the Temporary Login WordPress plugin allows attackers to compromise user accounts.

Vulnerability Details

CVE-ID: CVE-2026-7567

Affected Software: WordPress Temporary Login plugin

Affected Versions: up to and including 1.0.0

Vulnerability: The maybe_login_temporary_user() function improperly handles the temp-login-token parameter, allowing an array input to bypass security checks and return all users associated with the temporary login meta key.

Business Impact

With a CVSS score of 9.8, this flaw allows unauthenticated remote attackers to gain unauthorized access to the WordPress environment. This could lead to full site takeover, data exfiltration, or the modification of site content.

Remediation Plan

Immediate Action: Update the Temporary Login plugin to the latest version available from the vendor.

Proactive Monitoring: Review WordPress user access logs for unusual login activity or spikes in authentication attempts using temporary login tokens.

Compensating Controls: Use a Web Application Firewall (WAF) to block requests containing array-based inputs for the temp-login-token parameter.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Site administrators should update the affected plugin immediately. Given the ease of exploitation, this vulnerability poses a significant risk to the security and integrity of the affected WordPress site.

---METADATA---
VENDOR: Singularity (Advanced Database Cleaner)
PRODUCT: Advanced Database Cleaner – Premium
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: patch, technical_details
---END_METADATA---

Description Summary:
The Advanced Database Cleaner – Premium plugin for WordPress is vulnerable to Local File Inclusion, potentially allowing unauthorized file access.

Executive Summary:
A Local File Inclusion vulnerability in the Advanced Database Cleaner – Premium plugin for WordPress poses a significant risk of unauthorized file system access.

Vulnerability Details

CVE-ID: CVE-2026-7522

Affected Software: Singularity Advanced Database Cleaner – Premium

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a Local File Inclusion (LFI) flaw that may allow an attacker to include arbitrary files on the server. The specific authentication requirements are not explicitly stated, but LFI vulnerabilities in WordPress plugins often bypass standard access controls.

Business Impact

Successful exploitation of this vulnerability could lead to the exposure of sensitive configuration files, credentials, or source code, resulting in complete system compromise. With a CVSS score of 8.8, this flaw represents a high risk to business operations, potentially leading to data breaches and the loss of site integrity.

Remediation Plan

Immediate Action: Update the Advanced Database Cleaner – Premium plugin to the latest available version provided by the vendor. If an update is not currently available, consider disabling or removing the plugin until a secure version is released.

Proactive Monitoring: Monitor server logs for suspicious file inclusion patterns, such as directory traversal characters (e.g., ../) in URL parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common Local File Inclusion attack vectors.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score, administrators should treat this vulnerability with high priority. Ensure that the plugin is patched immediately upon the release of a security update by the vendor to prevent potential unauthorized access to the underlying server.

---METADATA---
VENDOR: WordPress
PRODUCT: Read More & Accordion plugin
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: high
MISSING: patch, technical_details
---END_METADATA---

Description Summary:
The Read More & Accordion plugin for WordPress contains a privilege escalation vulnerability in all versions up to and including 3.

Executive Summary:
The Read More & Accordion plugin for WordPress is susceptible to a privilege escalation vulnerability that could allow unauthorized users to gain elevated administrative rights.

Vulnerability Details

CVE-ID: CVE-2026-7467

Affected Software: WordPress Read More & Accordion plugin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin fails to properly validate user capabilities, allowing an attacker to perform privilege escalation. While the authentication requirement is not explicitly detailed, privilege escalation vulnerabilities in WordPress plugins typically require low-level authenticated access to trigger.

Business Impact

Successful exploitation of this vulnerability presents a critical risk, as it allows unauthorized users to escalate their privileges to an administrative level. This could lead to full site compromise, unauthorized data access, and potential malware injection, justifying the high CVSS score of 8.8.

Remediation Plan

Immediate Action: Identify and update the Read More & Accordion plugin to the latest available version provided by the vendor.

Proactive Monitoring: Audit WordPress user accounts for suspicious activity or unauthorized changes to user roles.

Compensating Controls: Implement a Web Application Firewall (WAF) to block suspicious requests targeting plugin-specific administrative functions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the severity of privilege escalation, administrators must prioritize updating the plugin immediately. If a patch is not currently available, consider disabling or removing the plugin until a secure version is released to prevent potential site takeovers.

---METADATA---
VENDOR: WordPress
PRODUCT: Spectra Gutenberg Blocks – Website Builder for the Block Editor
AFFECTED_VERSIONS: all versions up to, and including, 2.19.25
---END_METADATA---

Description Summary:
The Spectra Gutenberg Blocks plugin for WordPress contains a remote code execution vulnerability due to improper block rendering logic.

Executive Summary:
A critical remote code execution vulnerability in the Spectra Gutenberg Blocks plugin allows unauthenticated attackers to execute arbitrary code via specially crafted post content.

Vulnerability Details

CVE-ID: CVE-2026-7465

Affected Software: WordPress Spectra Gutenberg Blocks – Website Builder for the Block Editor

Affected Versions: all versions up to, and including, 2.19.25

Vulnerability: This vulnerability involves a flaw in block processing that allows for arbitrary code execution. An attacker can embed a two-block payload in post content to register a fake block type and subsequently trigger a render callback via call_user_func() during page rendering.

Business Impact

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary code on the underlying web server, potentially leading to full site compromise, data exfiltration, and unauthorized administrative access. Given the CVSS score of 8.8, this flaw represents a significant risk to organizational data integrity and system availability.

Remediation Plan

Immediate Action: Update the Spectra Gutenberg Blocks plugin to the latest version (greater than 2.19.25) immediately to patch the rendering logic flaw.

Proactive Monitoring: Inspect WordPress post content for suspicious blocks containing "uagb/" prefixes or unusual render callback definitions.

Compensating Controls: Utilize a Web Application Firewall (WAF) with updated rulesets designed to detect and block malicious Gutenberg block injections or serialized PHP objects.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 31, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw—which allows for arbitrary code execution—the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action. Administrators must prioritize updating the Spectra Gutenberg Blocks plugin to the latest version to neutralize the remote code execution vector. Failure to apply this update leaves the WordPress environment susceptible to complete takeover.

---METADATA---
VENDOR: PickPlugins
PRODUCT: User Verification
AFFECTED_VERSIONS: up to and including 2.0.46
---END_METADATA---

Description Summary:
The User Verification plugin for WordPress is vulnerable to authentication bypass due to loose comparison of OTP codes, allowing unauthenticated login.

Executive Summary:
An authentication bypass in the User Verification by PickPlugins WordPress plugin allows unauthenticated attackers to log in as any verified user, including administrators.

Vulnerability Details

CVE-ID: CVE-2026-7458

Affected Software: PickPlugins User Verification

Affected Versions: up to and including 2.0.46

Vulnerability: The vulnerability stems from the use of a loose PHP comparison operator when validating OTP codes. This allows an attacker to bypass the verification process by providing a "true" value as the OTP.

Business Impact

This flaw carries a CVSS score of 9.8, indicating extreme risk. An attacker can gain administrative access to the WordPress site, resulting in complete site compromise and potential data breach.

Remediation Plan

Immediate Action: Update the User Verification by PickPlugins plugin to the latest version immediately.

Proactive Monitoring: Monitor authentication logs for suspicious successful logins and verify that all administrative logins are coming from trusted sources.

Compensating Controls: Temporarily disable the plugin if an update is not immediately available to mitigate the risk of unauthorized access.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The vulnerability is trivial to exploit and provides high-level access. Administrators must patch this plugin immediately to prevent unauthorized administrative account takeover.

---METADATA---
VENDOR: TinyPNG
PRODUCT: JPEG, PNG & WebP image compression plugin
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The TinyPNG plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient input validation within the delete_converted_image_size function.

Executive Summary:
A critical arbitrary file deletion vulnerability in the TinyPNG WordPress plugin exposes the underlying server filesystem to unauthorized modification and potential service disruption.

Vulnerability Details

CVE-ID: CVE-2026-7311

Affected Software: TinyPNG JPEG, PNG & WebP image compression plugin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin fails to adequately sanitize user-supplied input within the delete_converted_image_size function. This allows an authenticated attacker with sufficient privileges to delete arbitrary files on the web server.

Business Impact

The ability for an attacker to delete arbitrary files poses a severe risk to system integrity and availability. An attacker could remove critical configuration files, core WordPress files, or security-related logs, potentially leading to a complete denial-of-service or facilitating further system compromise. With a CVSS score of 8.1, this high-severity flaw requires immediate attention to prevent operational downtime.

Remediation Plan

Immediate Action: Update the TinyPNG plugin to the latest available version provided by the vendor to implement proper path validation.

Proactive Monitoring: Monitor server file system activity logs for unauthorized deletion attempts or access patterns targeting sensitive directories.

Compensating Controls: Implement file integrity monitoring (FIM) and ensure the web server service account operates with the principle of least privilege regarding filesystem permissions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates prompt remediation. Administrators should verify their current plugin version and apply updates immediately. If a patch is not yet available, consider disabling the plugin until a secure version is released to mitigate the risk of filesystem manipulation.

---METADATA---
VENDOR: Easy Elements
PRODUCT: Easy Elements for Elementor
AFFECTED_VERSIONS: Up to and including 1.4.4
---END_METADATA---

Description Summary:
The Easy Elements for Elementor plugin is vulnerable to privilege escalation, allowing unauthenticated users to register as administrators.

Executive Summary:
A critical privilege escalation vulnerability in the Easy Elements for Elementor WordPress plugin allows unauthenticated attackers to gain administrative access to the site.

Vulnerability Details

CVE-ID: CVE-2026-7284

Affected Software: Easy Elements for Elementor

Affected Versions: Up to and including 1.4.4

Vulnerability: The easyel_handle_register function fails to restrict user roles during registration. An unauthenticated attacker can supply the 'administrator' role during the registration process to gain full control.

Business Impact

A CVSS score of 9.8 highlights the severity of this access control flaw. An attacker can register an administrative account, effectively taking over the entire WordPress site, which can lead to total data loss, site defacement, or the installation of backdoors.

Remediation Plan

Immediate Action: Update the Easy Elements for Elementor plugin to the latest version. Check the vendor advisory for specific patch details.

Proactive Monitoring: Review the user list for any unauthorized administrator accounts created recently and check registration logs.

Compensating Controls: Disable site registration if not strictly required, or implement an approval process for new user accounts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrative privilege escalation is one of the most critical vulnerabilities an application can face. Administrators must act immediately to update the plugin and perform a thorough audit of all existing user accounts to ensure no unauthorized administrators have been created.

---METADATA---
VENDOR: Highland Software
PRODUCT: Custom Role Manager
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Highland Software Custom Role Manager plugin for WordPress is susceptible to privilege escalation, allowing unauthorized users to obtain elevated permissions.

Executive Summary:
A privilege escalation vulnerability in the Highland Software Custom Role Manager plugin for WordPress could allow an authenticated attacker to gain administrative control over the site.

Vulnerability Details

CVE-ID: CVE-2026-7106

Affected Software: Highland Software Custom Role Manager

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin lacks proper capability checks during role management operations. An attacker with standard user access can exploit this flaw to modify user roles and escalate their privileges to administrator.

Business Impact

With a CVSS score of 8.8, this is a high-severity vulnerability. Successful exploitation grants an attacker full control over the WordPress site, allowing them to install malicious plugins, exfiltrate data, or modify site content, causing massive reputational and operational damage.

Remediation Plan

Immediate Action: Update the Custom Role Manager plugin to the latest version. If no update is available, deactivate and remove the plugin immediately.

Proactive Monitoring: Review WordPress user account logs for unexpected role changes or new administrative accounts.

Compensating Controls: Enforce strict WordPress security settings, including the use of strong passwords and multi-factor authentication for all administrative accounts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of privilege escalation flaws, the potential for exploitation is high.

Analyst Recommendation

WordPress administrators must prioritize the update of this plugin. Given the risk of total site compromise, if an update is not immediately available, the plugin should be disabled until a secure version is released to ensure the security of the site's administration.

---METADATA---
VENDOR: BookingPress
PRODUCT: BookingPress Pro
AFFECTED_VERSIONS: all versions up to, and including, 5.6
---END_METADATA---

Description Summary:
The BookingPress Pro plugin for WordPress contains an arbitrary file upload vulnerability that can lead to unauthenticated remote code execution.

Executive Summary:
A critical arbitrary file upload vulnerability in the BookingPress Pro plugin for WordPress poses a severe risk of unauthenticated remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-6960

Affected Software: BookingPress, BookingPress Pro

Affected Versions: all versions up to, and including, 5.6

Vulnerability: The vulnerability exists due to missing file type validation in the 'bookingpress_validate_submitted_booking_form_func' function. This allows an unauthenticated attacker to upload malicious files, specifically if a signature custom field is enabled on the booking form, leading to potential remote code execution.

Business Impact

With a CVSS score of 9.8, this vulnerability is classified as critical. Successful exploitation provides attackers with the ability to execute arbitrary code on the underlying server, potentially leading to a complete system compromise, unauthorized access to sensitive booking data, and significant operational disruption.

Remediation Plan

Immediate Action: Update to the latest version of BookingPress Pro immediately to apply the necessary file validation patches.

Proactive Monitoring: Review web server access logs for anomalous file upload attempts or requests to unexpected file types within the plugin's upload directory.

Compensating Controls: Implement a Web Application Firewall (WAF) to block suspicious file upload requests and restrict access to the booking form interface if feasible.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical severity and the ease of exploitation via the booking form, immediate patching is required. Administrators should verify their plugin version and apply updates without delay to prevent potential system-wide compromise.

---METADATA---
VENDOR: Premmerce
PRODUCT: Dev Tools
AFFECTED_VERSIONS: <= 2
---END_METADATA---

Description Summary:
The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution due to missing authorization checks in versions up to 2.

Executive Summary:
A critical authorization bypass vulnerability in the Premmerce Dev Tools plugin allows unauthenticated attackers to achieve Remote Code Execution (RCE).

Vulnerability Details

CVE-ID: CVE-2026-6933

Affected Software: Premmerce Dev Tools

Affected Versions: <= 2

Vulnerability: The plugin fails to perform proper authorization checks on critical functions, allowing an unauthenticated attacker to execute arbitrary code on the underlying server.

Business Impact

With a CVSS score of 8.8, this is an extremely dangerous vulnerability. An attacker can achieve complete control over the WordPress installation, potentially gaining full server access, installing backdoors, or pivoting into the internal network.

Remediation Plan

Immediate Action: Update the Premmerce Dev Tools plugin immediately or deactivate and remove the plugin if it is not strictly required for production operations.

Proactive Monitoring: Monitor server logs for unexpected process execution or modifications to WordPress core files.

Compensating Controls: Use a Web Application Firewall (WAF) to block unauthorized requests to the vulnerable plugin endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Remote Code Execution vulnerabilities require immediate attention. Given the ease with which an unauthenticated attacker can exploit this, all instances of the Premmerce Dev Tools plugin must be updated or removed from the environment without delay.

---METADATA---
VENDOR: WishList Products
PRODUCT: WishList Member
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The WishList Member plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check.

Executive Summary:
A high-severity authorization vulnerability in the WishList Member WordPress plugin allows attackers to modify sensitive data by bypassing capability checks.

Vulnerability Details

CVE-ID: CVE-2026-6898

Affected Software: WishList Products WishList Member

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in the 'WishListMember3_Hooks::generate_api_key' function, which lacks proper capability checks. This allows an unauthorized user to invoke administrative functions and modify system data.

Business Impact

A CVSS score of 8.8 highlights the severity of this flaw. Exploitation could lead to unauthorized API key generation, granting attackers persistent access to the platform and the ability to manipulate member data or compromise sensitive site information.

Remediation Plan

Immediate Action: Update the WishList Member plugin to the latest version provided by the vendor.

Proactive Monitoring: Check logs for unauthorized calls to API generation functions or unusual administrative activity.

Compensating Controls: Restrict access to the WordPress administrative dashboard to trusted IP addresses only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Missing capability checks are a significant security oversight. Administrators must apply the latest plugin updates immediately to ensure that administrative functions are protected by proper authorization requirements.

---METADATA---
VENDOR: WishList Products
PRODUCT: WishList Member
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The WishList Member plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check.

Executive Summary:
A high-severity authorization vulnerability in the WishList Member WordPress plugin allows attackers to modify system settings by bypassing capability checks.

Vulnerability Details

CVE-ID: CVE-2026-6897

Affected Software: WishList Products WishList Member

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in the 'WishListMember\Features\Team_Accounts::save_settings' function, which fails to verify user capabilities. This allows unauthorized users to modify plugin settings.

Business Impact

A CVSS score of 8.8 indicates a high risk. Exploitation could allow an attacker to alter core plugin settings, potentially weakening the site's security posture or redirecting member traffic.

Remediation Plan

Immediate Action: Update the WishList Member plugin to the latest version.

Proactive Monitoring: Regularly review plugin configuration settings for any unexpected changes.

Compensating Controls: Limit access to the WordPress backend to trusted network locations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Capability checks are fundamental to plugin security. Administrators should update the WishList Member plugin immediately to ensure that configuration settings are protected from unauthorized modification.

---METADATA---
VENDOR: WishList Products
PRODUCT: WishList Member
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The WishList Member plugin for WordPress is vulnerable to sensitive information disclosure and privilege escalation due to missing authorization.

Executive Summary:
A high-severity vulnerability in the WishList Member WordPress plugin allows attackers to disclose sensitive information and escalate privileges through missing authorization.

Vulnerability Details

CVE-ID: CVE-2026-6895

Affected Software: WishList Products WishList Member

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin lacks necessary authorization checks, enabling an attacker to access sensitive information and escalate their privileges. This flaw exposes the internal workings and user account structure of the plugin.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a significant risk of data breach and account takeover. Unauthorized access to sensitive information can lead to further exploitation, while privilege escalation grants attackers administrative control.

Remediation Plan

Immediate Action: Update the WishList Member plugin to the latest version immediately.

Proactive Monitoring: Monitor site traffic for unusual access to administrative or configuration endpoints.

Compensating Controls: Ensure that sensitive directories are protected and that access logs are monitored for anomalous activity.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is critical due to the combination of information disclosure and privilege escalation. Administrators must update the plugin immediately to secure the site against these threats.

---METADATA---
VENDOR: Transbank
PRODUCT: Webpay WordPress Plugin
AFFECTED_VERSIONS: before 1.14.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Transbank Webpay WordPress plugin contains a stored XSS vulnerability that allows unauthenticated attackers to inject malicious scripts into plugin logs.

Executive Summary:
A stored Cross-Site Scripting vulnerability in the Transbank Webpay plugin allows unauthenticated attackers to hijack administrator sessions via malicious log entries.

Vulnerability Details

CVE-ID: CVE-2026-6858

Affected Software: Transbank Webpay WordPress Plugin

Affected Versions: before 1.14.0

Vulnerability: This is a stored Cross-Site Scripting (XSS) vulnerability caused by the failure to sanitize or HTML-encode log data. Unauthenticated attackers can inject malicious scripts into the plugin's logs, which then execute when an administrator views the logs in the WordPress dashboard.

Business Impact

The CVSS score of 7.1 highlights the critical risk of this vulnerability. Because the script executes in the browser of an administrator, an attacker can achieve session hijacking, steal sensitive administrative credentials, or perform unauthorized administrative actions, leading to a complete compromise of the WordPress site.

Remediation Plan

Immediate Action: Upgrade the Transbank Webpay WordPress plugin to version 1.14.0 or later to patch the underlying sanitization flaw.

Proactive Monitoring: Audit existing plugin logs for any suspicious or non-standard entries that may contain obfuscated JavaScript or script tags.

Compensating Controls: Utilize a WAF to inspect incoming traffic and block requests containing script injection patterns before they reach the plugin's logging functionality.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is particularly dangerous because it does not require prior authentication to trigger. Immediate patching is required to prevent attackers from using the logging mechanism as a persistence or privilege escalation vector.

---METADATA---
VENDOR: ProSolution
PRODUCT: WP Client
AFFECTED_VERSIONS: Up to and including 2.0.0
---END_METADATA---

Description Summary:
The ProSolution WP Client WordPress plugin is vulnerable to arbitrary file upload due to improper validation of the upload array, allowing remote code execution.

Executive Summary:
A critical arbitrary file upload vulnerability in the ProSolution WP Client WordPress plugin allows unauthenticated attackers to execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2026-6555

Affected Software: ProSolution WP Client for WordPress

Affected Versions: Up to and including 2.0.0

Vulnerability: The plugin fails to validate all files in an upload array, only checking the first one. An unauthenticated attacker can bypass these checks to upload malicious PHP files to a web-accessible directory.

Business Impact

A CVSS score of 9.8 indicates an extremely high level of risk. An attacker can use this flaw to gain full control of the WordPress instance, potentially leading to the compromise of user databases and the use of the server for malicious activity.

Remediation Plan

Immediate Action: Update the ProSolution WP Client plugin to the latest version. Check the vendor security advisory for specific patch details.

Proactive Monitoring: Review web server logs for suspicious file upload requests and scan the site for unauthorized PHP scripts.

Compensating Controls: Configure the web server to disable script execution in the directory where user files are uploaded.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is a prime example of why input validation must be exhaustive across all data inputs. Immediate updates are required, and organizations should scan their web directories for any signs of unauthorized file activity.

---METADATA---
VENDOR: InfusedWoo
PRODUCT: InfusedWoo Pro Plugin for WordPress
AFFECTED_VERSIONS: Up to and including 5.1.2
---END_METADATA---

Description Summary:
The InfusedWoo Pro plugin for WordPress is vulnerable to an authorization bypass that allows unauthenticated attackers to perform destructive actions on site content.

Executive Summary:
An authorization bypass flaw in the InfusedWoo Pro plugin for WordPress enables unauthenticated attackers to delete posts, pages, and orders, or modify site status.

Vulnerability Details

CVE-ID: CVE-2026-6512

Affected Software: InfusedWoo, InfusedWoo Pro Plugin for WordPress

Affected Versions: Up to and including 5.1.2

Vulnerability: The plugin fails to perform adequate authorization checks on critical administrative functions. This allows unauthenticated attackers to trigger destructive actions, including mass-deletion of comments and modification of post statuses.

Business Impact

This vulnerability carries a CVSS score of 9.1, reflecting its potential for severe operational disruption. Successful exploitation could lead to significant data loss, destruction of e-commerce records, and long-term reputational damage to the affected business entity.

Remediation Plan

Immediate Action: Update the InfusedWoo Pro plugin to the latest version immediately.

Proactive Monitoring: Regularly audit site content and database logs to identify unauthorized modifications or deletions of critical business records.

Compensating Controls: Restrict access to administrative endpoints via a WAF or IP-based allowlisting if an immediate update is not feasible.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates prompt action to prevent potential site defacement or data destruction. All administrators should prioritize updating the InfusedWoo Pro plugin to the latest version to restore proper authorization controls.

---METADATA---
VENDOR: WordPress
PRODUCT: InfusedWoo Pro Plugin
AFFECTED_VERSIONS: Up to and including 5.1.2
---END_METADATA---

Description Summary:
The InfusedWoo Pro WordPress plugin is vulnerable to authentication bypass and privilege escalation via an insecure AJAX handler.

Executive Summary:
A critical privilege escalation vulnerability in the InfusedWoo Pro plugin allows unauthenticated attackers to gain administrative access via a crafted URL.

Vulnerability Details

CVE-ID: CVE-2026-6510

Affected Software: WordPress InfusedWoo Pro Plugin

Affected Versions: Up to and including 5.1.2

Vulnerability: The vulnerability stems from missing nonce verification and capability checks in the iwar_save_recipe() AJAX handler. An unauthenticated attacker can create a malicious recipe that forces an auto-login action, enabling them to hijack any user account, including administrators.

Business Impact

The CVSS score of 9.8 underscores the severity of this risk. Successful exploitation allows unauthorized users to gain full administrative privileges, leading to complete compromise of the WordPress site, user database exfiltration, and unauthorized content modification.

Remediation Plan

Immediate Action: Update the InfusedWoo Pro plugin to the latest version immediately to ensure proper authorization checks are implemented.

Proactive Monitoring: Review user account creation logs and audit administrative activity for suspicious logins or unauthorized changes to site configurations.

Compensating Controls: Use a WAF to restrict access to AJAX endpoints and monitor for unusual request patterns targeting the plugin's configuration files.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability grants attackers full control with minimal effort. It is imperative that administrators update the plugin immediately and audit existing user accounts for any signs of unauthorized account creation or privilege changes.

---METADATA---
VENDOR: WordPress
PRODUCT: Ajax Load More
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
The Ajax Load More plugin for WordPress contains an unspecified vulnerability in versions prior to 7.

Executive Summary:
The Ajax Load More plugin for WordPress is affected by an unspecified vulnerability that may pose a significant security risk to the host environment.

Vulnerability Details

CVE-ID: CVE-2026-6495

Affected Software: WordPress Ajax Load More

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in the Ajax Load More plugin for WordPress in all versions released prior to version 7. The specific nature of the flaw is currently unspecified, requiring further vendor disclosure to determine the exact attack vector and authentication requirements.

Business Impact

The identified vulnerability carries a CVSS score of 7.1, indicating a High-severity risk. Successful exploitation could lead to unauthorized system access, potential data exfiltration, or service disruption, directly impacting the integrity and availability of the WordPress site.

Remediation Plan

Immediate Action: Update the Ajax Load More plugin to version 7 or the latest available version provided by the vendor.

Proactive Monitoring: Monitor server logs for unusual traffic patterns or unauthorized requests directed at plugin-related endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to filter potentially malicious traffic targeting the WordPress environment.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity of this vulnerability, administrators should prioritize updating the plugin immediately. If an update is not currently feasible, consider disabling or removing the plugin until a secure version is verified and deployed.

---METADATA---
VENDOR: WordPress
PRODUCT: Account Switcher plugin
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: high
MISSING: patch, technical_details
---END_METADATA---

Description Summary:
The Account Switcher plugin for WordPress is vulnerable to privilege escalation in all versions up to and including 1.

Executive Summary:
The Account Switcher plugin for WordPress is susceptible to a privilege escalation vulnerability that could allow unauthorized users to gain elevated administrative rights.

Vulnerability Details

CVE-ID: CVE-2026-6456

Affected Software: WordPress Account Switcher plugin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin contains a flaw enabling privilege escalation, which typically allows an authenticated user to gain higher-level permissions than intended. The vulnerability suggests a lack of sufficient access control checks within the plugin's core functions.

Business Impact

A CVSS score of 8.8 indicates that this vulnerability is severe, as it facilitates unauthorized privilege escalation. This risk could allow an attacker to bypass standard security controls, potentially leading to a complete compromise of the WordPress environment and unauthorized access to user accounts.

Remediation Plan

Immediate Action: Update the Account Switcher plugin to the latest version. If no update is available, deactivate and remove the plugin immediately.

Proactive Monitoring: Review the site’s user database for any unexpected account role changes or the creation of new administrator accounts.

Compensating Controls: Utilize a WAF to monitor for and block unauthorized attempts to execute functions associated with account management or role modification.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The urgency of this vulnerability is high due to the potential for total administrative compromise. Administrators are advised to apply the necessary updates immediately or remove the plugin to eliminate the attack vector entirely.

---METADATA---
VENDOR: WordPress
PRODUCT: Accordion and Accordion Slider
AFFECTED_VERSIONS: 1.4.6
---END_METADATA---

Description Summary:
The Accordion and Accordion Slider plugin for WordPress version 1.4.6 contains a malicious backdoor injected by threat actors.

Executive Summary:
A critical supply chain compromise in the Accordion and Accordion Slider plugin introduces a persistent backdoor into all affected WordPress sites.

Vulnerability Details

CVE-ID: CVE-2026-6443

Affected Software: WordPress Accordion and Accordion Slider

Affected Versions: 1.4.6

Vulnerability: The plugin was acquired by malicious actors who subsequently injected a backdoor into the source code. This allows for persistent unauthorized access and the injection of spam content into the host site.

Business Impact

With a CVSS score of 9.8, this represents a total compromise of the affected website's integrity. The backdoor allows for ongoing unauthorized access, potential data theft, and significant reputational damage due to injected spam.

Remediation Plan

Immediate Action: Immediately remove the plugin from all WordPress installations. Do not rely on updates from the current maintainer.

Proactive Monitoring: Scan the site file system for unauthorized scripts and monitor database logs for suspicious content injections.

Compensating Controls: Implement a file integrity monitoring (FIM) solution to detect unauthorized changes to core or plugin files.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Because this is a deliberate backdoor, the plugin should be considered permanently untrusted. Organizations must remove the plugin immediately and perform a forensic audit of the site to identify any previously injected malicious code.

---METADATA---
VENDOR: WishList Products
PRODUCT: WishList Member
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The WishList Member plugin for WordPress is vulnerable to privilege escalation due to missing authorization.

Executive Summary:
A high-severity vulnerability in the WishList Member WordPress plugin allows unauthorized users to escalate their privileges, potentially gaining administrative control.

Vulnerability Details

CVE-ID: CVE-2026-6419

Affected Software: WishList Products WishList Member

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability stems from missing authorization controls, allowing users to perform actions they should not have the permissions to execute. This can be leveraged to escalate privileges within the application.

Business Impact

The CVSS score of 8.8 underscores the gravity of this flaw. By escalating privileges, an attacker can gain unrestricted control over the WordPress site, leading to the compromise of member data and administrative configuration settings.

Remediation Plan

Immediate Action: Update the WishList Member plugin to the latest version.

Proactive Monitoring: Audit user roles and permissions periodically to identify any unauthorized escalations.

Compensating Controls: Implement a WAF to detect and block common privilege escalation attempts directed at plugin-specific endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Protecting against unauthorized privilege escalation is vital for maintaining the security of the CMS. Administrators must update the WishList Member plugin as soon as a patch is available.

---METADATA---
VENDOR: WordPress (Plugin Developer)
PRODUCT: Quick Playground
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: patch, technical_details
---END_METADATA---

Description Summary:
The Quick Playground plugin for WordPress is susceptible to a path traversal vulnerability, allowing unauthorized access to arbitrary files on the host server.

Executive Summary:
The WordPress Quick Playground plugin contains a path traversal vulnerability that could allow unauthenticated attackers to read sensitive files from the underlying server.

Vulnerability Details

CVE-ID: CVE-2026-6403

Affected Software: WordPress Quick Playground

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin fails to adequately sanitize user input, enabling path traversal attacks. This typically allows an attacker to bypass directory restrictions and access files outside the intended web root.

Business Impact

This vulnerability carries a CVSS score of 7.5 (High), indicating a severe risk to data confidentiality. Unauthorized access to server-side files may expose configuration files, database credentials, or sensitive application code, potentially leading to full site compromise and significant reputational damage.

Remediation Plan

Immediate Action: Update the Quick Playground plugin to the latest available version provided by the developer, or remove the plugin if it is not strictly required for business operations.

Proactive Monitoring: Review web server access logs for requests containing directory traversal sequences (e.g., "../") targeting sensitive system files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common path traversal patterns and directory manipulation attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

WordPress administrators should treat this as a high-priority update. Given the risk of remote file disclosure, immediate remediation is required, and any site using this plugin should be audited for signs of previous unauthorized access.

---METADATA---
VENDOR: Unknown
PRODUCT: FileOrganizer, Advanced File Manager, File Manager Pro, File Manager
AFFECTED_VERSIONS: FileOrganizer < 1.1.9, Advanced File Manager < 5.4.12, File Manager Pro < 2.1.1, File Manager < 8.0.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Several WordPress file management plugins are vulnerable to OS Command Injection when processing images, allowing authenticated users with administrative privileges to execute arbitrary commands.

Executive Summary:
Multiple WordPress file management plugins contain an OS Command Injection vulnerability that allows authenticated administrative users to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2026-6382

Affected Software: FileOrganizer, Advanced File Manager, File Manager Pro, and File Manager WordPress plugins

Affected Versions: See metadata for version thresholds

Vulnerability: The vulnerability occurs because the plugins fail to properly escape parameters before passing them to shell commands during image processing. This exploit requires the attacker to be authenticated with high-level privileges (e.g., administrator).

Business Impact

Successful exploitation allows an authenticated administrator to execute arbitrary commands on the underlying server. While this requires authentication, the impact is severe, potentially allowing an attacker to escalate privileges, access sensitive files, or gain a shell on the web server. The CVSS score of 9.1 reflects the high potential for total system compromise.

Remediation Plan

Immediate Action: Update the affected WordPress plugins to the latest versions that include the security fixes (FileOrganizer 1.1.9, Advanced File Manager 5.4.12, File Manager Pro 2.1.1, or File Manager 8.0.4).

Proactive Monitoring: Audit user account activity and review administrative logs for unauthorized or unexpected file management operations.

Compensating Controls: Disable the affected plugin functionality if it is not business-critical, or restrict administrative access to trusted personnel only.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should treat this vulnerability with high urgency. Given the requirement for administrative authentication, ensure that the principle of least privilege is applied to user accounts and update all listed plugins to the patched versions immediately.

---METADATA---
VENDOR: WordPress
PRODUCT: WP Maps
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
The WP Maps plugin for WordPress contains an unspecified vulnerability in versions prior to 4.

Executive Summary:
The WP Maps plugin for WordPress is affected by an unspecified vulnerability that may pose a significant security risk to the host environment.

Vulnerability Details

CVE-ID: CVE-2026-6381

Affected Software: WordPress WP Maps

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the WP Maps plugin for WordPress in all versions prior to 4. The lack of specific technical details regarding the vulnerability type necessitates caution until the vendor provides further remediation documentation.

Business Impact

With a CVSS score of 7.5, this vulnerability is classified as High severity. Exploitation could allow attackers to compromise the underlying WordPress installation, leading to unauthorized access or potential data loss.

Remediation Plan

Immediate Action: Update the WP Maps plugin to version 4 or the latest available version provided by the vendor.

Proactive Monitoring: Review administrative access logs and plugin configurations for signs of unauthorized modifications or suspicious activity.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect incoming traffic for common web attack patterns that may target vulnerable plugin functions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should treat this vulnerability with urgency by applying the necessary plugin updates. Where updates cannot be immediately applied, assess the necessity of the plugin and consider removal to reduce the attack surface.

---METADATA---
VENDOR: WordPress
PRODUCT: WP Photo Album Plus
AFFECTED_VERSIONS: 0 up to (excluding) 9.1.11.001
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The WP Photo Album Plus plugin for WordPress is vulnerable to SQL Injection, allowing attackers to execute unauthorized database queries.

Executive Summary:
The WP Photo Album Plus plugin for WordPress is vulnerable to SQL Injection, which could allow an attacker to gain unauthorized access to sensitive database information.

Vulnerability Details

CVE-ID: CVE-2026-6379

Affected Software: WordPress WP Photo Album Plus

Affected Versions: 0 up to (excluding) 9.1.11.001

Vulnerability: This vulnerability is a SQL Injection (CWE-89) within the WP Photo Album Plus plugin. It allows an unauthenticated or authenticated attacker to manipulate database queries, potentially leading to unauthorized data disclosure or modification.

Business Impact

With a CVSS score of 8.6, this is a High-severity vulnerability with significant business risk. Successful exploitation could result in the total compromise of the database, leading to the theft of user credentials, personal information, or administrative site data.

Remediation Plan

Immediate Action: Update the WP Photo Album Plus plugin to version 9.1.11.001 or later immediately.

Proactive Monitoring: Monitor database query logs for syntax errors or anomalous patterns associated with SQL Injection attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) with SQL injection protection rules to block malicious payloads targeting the database.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

SQL Injection vulnerabilities are critical risks. Administrators must apply the patch to version 9.1.11.001 immediately to prevent potential database compromise. If patching is delayed, restrict access to the affected site functionality.

---METADATA---
VENDOR: WordPress
PRODUCT: Career Section Plugin
AFFECTED_VERSIONS: Up to and including 1.7
---END_METADATA---

Description Summary:
The Career Section WordPress plugin is vulnerable to arbitrary file upload due to missing file type validation, enabling remote code execution.

Executive Summary:
An unauthenticated arbitrary file upload vulnerability in the Career Section plugin for WordPress allows attackers to execute remote code on the server.

Vulnerability Details

CVE-ID: CVE-2026-6271

Affected Software: WordPress Career Section Plugin

Affected Versions: Up to and including 1.7

Vulnerability: This is an arbitrary file upload vulnerability caused by the lack of proper file type validation within the CV upload handler. An unauthenticated attacker can upload malicious executable files, such as web shells, leading to full remote code execution.

Business Impact

With a CVSS score of 9.8, this vulnerability is critical. An attacker can gain full administrative control over the web server, leading to site defacement, data theft, and potential lateral movement into the hosting infrastructure.

Remediation Plan

Immediate Action: Update the Career Section plugin to the latest available version that contains the fix for file type validation.

Proactive Monitoring: Scan the web server's upload directories for suspicious file extensions (.php, .phtml, .exe) and review server access logs for unusual POST requests to the upload handler.

Compensating Controls: Use a Web Application Firewall (WAF) to block requests containing suspicious file extensions or unauthorized file upload attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

File upload vulnerabilities are high-value targets for attackers. Organizations using this plugin must verify if they are running version 1.7 or lower and apply the update immediately. If an update is unavailable, disable the plugin until a secure version is released.

---METADATA---
VENDOR: Betheme
PRODUCT: Betheme
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Betheme theme for WordPress is vulnerable to arbitrary file upload, which can allow attackers to execute malicious code on the server.

Executive Summary:
A critical arbitrary file upload vulnerability in the Betheme WordPress theme enables attackers to perform remote code execution, posing a severe risk to server security.

Vulnerability Details

CVE-ID: CVE-2026-6261

Affected Software: Betheme

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is an arbitrary file upload vulnerability that allows an attacker to upload malicious files, such as web shells, to the server. If successful, this can lead to full site compromise and remote code execution.

Business Impact

With a CVSS score of 8.8, this is a critical vulnerability that grants an attacker the ability to execute code in the context of the web server. This could lead to complete site takeover, persistent backdoors, and potential lateral movement within the hosting infrastructure.

Remediation Plan

Immediate Action: Update the Betheme theme to the latest version immediately to close the insecure file upload vector.

Proactive Monitoring: Scan the web server directories for unauthorized or suspicious files, particularly in upload paths, and monitor for unexpected server-side execution logs.

Compensating Controls: Restrict file upload capabilities via server configurations and utilize a WAF to inspect and block non-authorized file types during upload requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a severe threat to server integrity. Administrators must prioritize updating the theme and performing a comprehensive security audit of the file system to ensure no malicious artifacts were introduced prior to the patch.

---METADATA---
VENDOR: Sendmachine
PRODUCT: Sendmachine for WordPress
AFFECTED_VERSIONS: Up to and including 1.0.20
---END_METADATA---

Description Summary:
The Sendmachine for WordPress plugin is vulnerable to an authorization bypass, allowing unauthenticated attackers to modify SMTP configurations.

Executive Summary:
An unauthenticated attacker can intercept site emails by exploiting an authorization bypass in the Sendmachine for WordPress plugin.

Vulnerability Details

CVE-ID: CVE-2026-6235

Affected Software: Sendmachine for WordPress

Affected Versions: Up to and including 1.0.20

Vulnerability: The manage_admin_requests function lacks proper capability checks, enabling unauthenticated attackers to alter the plugin's SMTP settings.

Business Impact

By hijacking the SMTP configuration, attackers can intercept sensitive communications, including password reset emails and authentication tokens, leading to potential account takeovers. With a CVSS score of 9.8, this vulnerability poses a severe threat to site security and user privacy.

Remediation Plan

Immediate Action: Update to the latest version of the Sendmachine for WordPress plugin.

Proactive Monitoring: Monitor SMTP configuration settings and email logs for any unauthorized changes or unexpected email routing behavior.

Compensating Controls: Use a Web Application Firewall (WAF) to block unauthorized requests to administrative plugin endpoints until a patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Site administrators should update the plugin immediately. Additionally, verify that current SMTP settings have not been tampered with and consider rotating credentials for any mail accounts previously configured in the plugin.

---METADATA---
VENDOR: DynamiApps
PRODUCT: Frontend Admin
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: high
MISSING: patch, technical_details
---END_METADATA---

Description Summary:
The Frontend Admin by DynamiApps plugin for WordPress contains an unauthenticated privilege escalation vulnerability allowing unauthorized account elevation.

Executive Summary:
The Frontend Admin plugin for WordPress is subject to a critical unauthenticated privilege escalation vulnerability that could allow attackers to gain unauthorized administrative access.

Vulnerability Details

CVE-ID: CVE-2026-6226

Affected Software: DynamiApps Frontend Admin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is an unauthenticated privilege escalation vulnerability residing within the Frontend Admin plugin. It allows remote, unauthenticated attackers to manipulate user roles or escalate their own privileges within the WordPress environment.

Business Impact

Successful exploitation of this flaw grants an attacker full administrative control over the WordPress instance. This leads to complete data compromise, potential malware injection, and the ability to pivot into the underlying server infrastructure. Given the CVSS score of 8.8, the risk to confidentiality, integrity, and availability is considered high.

Remediation Plan

Immediate Action: Update the Frontend Admin plugin to the latest available version provided by the vendor. If an update is not available, disable or remove the plugin from the production environment until a patch is released.

Proactive Monitoring: Review WordPress user account logs for suspicious account creation or role changes. Monitor administrative login activity for anomalous IP addresses or unusual timestamps.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block unauthorized requests targeting WordPress administrative functions or plugin-specific endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a severe risk due to the lack of authentication required for exploitation. Administrators should prioritize updating the plugin immediately or removing it if it is not essential for business operations to prevent unauthorized administrative access.

---METADATA---
VENDOR: CMSJunkie
PRODUCT: WP-BusinessDirectory
AFFECTED_VERSIONS: Up to and including 4.0.1
---END_METADATA---

Description Summary:
The WP-BusinessDirectory plugin for WordPress contains an unauthenticated arbitrary file deletion vulnerability due to insufficient path validation in the upload controller.

Executive Summary:
A critical vulnerability in the WP-BusinessDirectory plugin allows unauthenticated attackers to delete arbitrary files on the server, potentially leading to total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-6070

Affected Software: CMSJunkie WP-BusinessDirectory

Affected Versions: Up to and including 4.0.1

Vulnerability: This is an arbitrary file deletion vulnerability caused by improper sanitization of the _filename parameter in the JBusinessDirectoryControllerUpload class. Unauthenticated attackers can leverage path traversal sequences to reach and delete critical system files, such as wp-config.php, via the plugin's frontend routing.

Business Impact

The ability for an unauthenticated attacker to delete critical configuration files poses a severe risk to business continuity and data integrity. With a CVSS score of 9.1, this flaw could result in complete service disruption (denial of service) or allow an attacker to reconfigure the application environment to facilitate further exploitation, leading to significant reputational and operational damage.

Remediation Plan

Immediate Action: Update the WP-BusinessDirectory plugin to the latest available version immediately to patch the file deletion logic.

Proactive Monitoring: Review server access logs for suspicious requests targeting task=upload.remove and monitor for unexpected file deletion events or sudden site outages.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing path traversal sequences (e.g., ../) directed toward the plugin's upload endpoints.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical severity of this vulnerability and the ease of exploitation, immediate remediation is required. Administrators should prioritize updating the plugin across all affected WordPress installations to prevent unauthorized file deletion and potential server-side compromise.

---METADATA---
VENDOR: Image Optimizer
PRODUCT: Image Optimizer – Optimize Images and Convert to WebP or AVIF
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Image Optimizer plugin for WordPress contains a vulnerability allowing for arbitrary file deletion due to inadequate path validation.

Executive Summary:
An arbitrary file deletion flaw in the Image Optimizer plugin for WordPress risks critical data loss and server instability through unauthorized filesystem access.

Vulnerability Details

CVE-ID: CVE-2026-5821

Affected Software: Image Optimizer – Optimize Images and Convert to WebP or AVIF

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability stems from improper validation of file paths during image processing operations. An attacker can leverage this flaw to delete files outside of the intended directory, provided they have sufficient authentication levels.

Business Impact

Successful exploitation allows an attacker to delete mission-critical system files, potentially rendering the website or the underlying host server inoperable. Given the CVSS score of 8.1, this vulnerability presents a significant risk to the availability and reliability of the WordPress environment, which could result in prolonged business interruption.

Remediation Plan

Immediate Action: Update the Image Optimizer plugin to the latest version immediately upon the release of a security patch by the vendor.

Proactive Monitoring: Review web server access logs for anomalous requests that deviate from normal plugin behavior, specifically those targeting file deletion endpoints.

Compensating Controls: Utilize a Web Application Firewall (WAF) to block requests containing directory traversal sequences or suspicious path parameters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for permanent data loss and service disruption, administrators are strongly advised to prioritize this update. Ensure that the plugin is kept up to date and audit the environment for any signs of unauthorized file manipulation.

---METADATA---
VENDOR: WPIDE
PRODUCT: File Manager & Code Editor
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An unauthenticated Cross-Site Request Forgery (CSRF) vulnerability exists in the WPIDE File Manager & Code Editor plugin, potentially allowing unauthorized actions.

Executive Summary:
The WPIDE File Manager & Code Editor plugin is susceptible to an unauthenticated CSRF vulnerability, which could allow remote attackers to perform unauthorized actions on behalf of a user.

Vulnerability Details

CVE-ID: CVE-2026-57766

Affected Software: WPIDE File Manager & Code Editor

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a Cross-Site Request Forgery (CSRF) vulnerability that does not require authentication, allowing an attacker to trick a logged-in user into executing unintended actions within the WordPress environment.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a significant risk to the integrity of the WordPress site. Successful exploitation could lead to unauthorized file manipulation or administrative actions, potentially resulting in full site compromise, data loss, or the injection of malicious code.

Remediation Plan

Immediate Action: Update the WPIDE plugin to the latest available version provided by the vendor to resolve the flaw.

Proactive Monitoring: Review web access logs for unusual POST requests or patterns originating from unauthorized sources targeting administrative plugin endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block suspicious cross-site requests and validate referer headers.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high severity of this CSRF vulnerability, administrators must prioritize identifying and updating the affected plugin. Failure to remediate could allow attackers to bypass security boundaries, necessitating immediate action to secure the application environment.

---METADATA---
VENDOR: LCweb
PRODUCT: PrivateContent
AFFECTED_VERSIONS: n/a through 9.9.2
---END_METADATA---

Description Summary:
LCweb PrivateContent is vulnerable to an incorrect privilege assignment flaw, potentially allowing an attacker to escalate privileges within the application.

Executive Summary:
An incorrect privilege assignment vulnerability in LCweb PrivateContent allows unauthenticated or low-privileged users to escalate their access, posing a critical security risk.

Vulnerability Details

CVE-ID: CVE-2026-57692

Affected Software: LCweb PrivateContent

Affected Versions: n/a through 9.9.2

Vulnerability: The vulnerability stems from improper handling of privilege assignments within the application logic. This flaw allows an attacker to manipulate user roles, effectively escalating privileges to gain unauthorized administrative access.

Business Impact

Successful exploitation of this vulnerability allows an attacker to gain full administrative control over the PrivateContent plugin. Given the CVSS score of 9.8, the business impact is severe, potentially resulting in complete data exfiltration, modification of user content, and the compromise of the entire WordPress environment hosting the plugin.

Remediation Plan

Immediate Action: Update LCweb PrivateContent to the latest version immediately to patch the privilege assignment logic.

Proactive Monitoring: Review system and application logs for suspicious user role changes or unauthorized administrative actions.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block suspicious requests targeting plugin-specific administrative functions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate remediation. Organizations should update their PrivateContent installation without delay to prevent unauthorized privilege escalation and maintain the integrity of their platform.

---METADATA---
VENDOR: Epsiloncool
PRODUCT: WP Fast Total Search
AFFECTED_VERSIONS: <= 1.80.280
---END_METADATA---

Description Summary:
An unauthenticated SQL injection vulnerability exists in Epsiloncool WP Fast Total Search versions 1.80.280 and earlier, allowing remote attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in Epsiloncool WP Fast Total Search poses a critical risk of unauthorized database access and potential data exfiltration.

Vulnerability Details

CVE-ID: CVE-2026-57683

Affected Software: Epsiloncool WP Fast Total Search

Affected Versions: <= 1.80.280

Vulnerability: This is an unauthenticated SQL injection vulnerability occurring within the search functionality of the plugin. An attacker can execute arbitrary SQL commands by injecting malicious payloads into vulnerable search parameters without requiring prior authentication.

Business Impact

Successful exploitation of this vulnerability can lead to full database compromise, potentially resulting in the theft of sensitive user data, credentials, and site configuration details. Given the CVSS score of 9.3, this flaw represents a critical threat to data integrity and confidentiality that must be addressed immediately to prevent unauthorized access.

Remediation Plan

Immediate Action: Update the Epsiloncool WP Fast Total Search plugin to the latest available version immediately.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, such as unexpected SQL syntax errors or attempts to access system tables.

Compensating Controls: Implement a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection patterns targeting WordPress plugins.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jul 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the lack of authentication requirements, the potential for automated exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates an immediate response. Administrators should prioritize patching the Epsiloncool WP Fast Total Search plugin across all affected environments to eliminate the risk of database compromise. Failure to update may expose the organization to significant data breach risks.

---METADATA---
VENDOR: Groundhogg
PRODUCT: Groundhogg
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the Groundhogg WordPress plugin allows authenticated sales representatives to execute arbitrary database queries.

Executive Summary:
A high-severity SQL injection vulnerability in the Groundhogg plugin allows authenticated sales representatives to compromise database integrity and access unauthorized information.

Vulnerability Details

CVE-ID: CVE-2026-57667

Affected Software: Groundhogg, Groundhogg

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the plugin’s database handling functions, allowing users with the "Sales Representative" role to inject arbitrary SQL commands. This flaw represents an authorization-level failure where input validation is insufficiently enforced for authenticated users.

Business Impact

The CVSS score of 8.5 highlights a critical risk to business operations relying on Groundhogg for CRM and marketing automation. Successful exploitation could result in the exfiltration of customer lists, lead data, or unauthorized modification of marketing workflows, severely impacting business continuity and data privacy compliance.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the Groundhogg development team to remediate the vulnerable code path.

Proactive Monitoring: Monitor database query performance and logs for suspicious activity or unauthorized access patterns specifically linked to accounts with sales representative privileges.

Compensating Controls: Deploy a Web Application Firewall (WAF) to intercept and block SQL injection strings before they reach the application layer.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, given that SQL injection is a well-understood attack vector, the potential for exploitation remains high.

Analyst Recommendation

Security teams must treat this vulnerability with high urgency. Ensure all plugins are updated to the latest version and perform a thorough audit of user permissions to ensure the principle of least privilege is strictly maintained.

---METADATA---
VENDOR: Zip Recipes
PRODUCT: Recipe Maker For Your Food Blog
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the Zip Recipes plugin for WordPress allows authenticated contributors to execute arbitrary database queries.

Executive Summary:
A high-severity SQL injection vulnerability in the Zip Recipes plugin allows authenticated contributors to manipulate database queries, risking unauthorized data access or modification.

Vulnerability Details

CVE-ID: CVE-2026-57663

Affected Software: Zip Recipes, Recipe Maker For Your Food Blog

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin suffers from a SQL injection vulnerability that can be triggered by a user with contributor-level permissions. This flaw allows an attacker to inject malicious SQL commands into the backend database.

Business Impact

This vulnerability poses a significant risk to the integrity and confidentiality of the WordPress database. With a CVSS score of 8.5, an attacker could potentially extract sensitive user information, modify site content, or elevate privileges, leading to complete site compromise and reputational damage.

Remediation Plan

Immediate Action: Update the Recipe Maker For Your Food Blog plugin to the latest available version as soon as a security patch is released by the vendor.

Proactive Monitoring: Review database error logs and audit trails for unusual query patterns or unexpected database access attempts originating from contributor accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) with SQL injection protection rules to filter malicious traffic and block unauthorized database queries.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of SQL injection flaws, the potential for exploitation by malicious actors is high.

Analyst Recommendation

Given the high CVSS score, organizations should prioritize updating this plugin immediately. Restrict contributor-level access to the WordPress dashboard until a patch is applied to mitigate the risk of unauthorized database manipulation.

---METADATA---
VENDOR: Jay
PRODUCT: Child Theme Wizard
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An unauthenticated Cross-Site Request Forgery (CSRF) vulnerability exists in the Child Theme Wizard plugin, allowing unauthorized actions to be performed on behalf of a victim.

Executive Summary:
The Child Theme Wizard plugin is vulnerable to unauthenticated CSRF attacks, which could allow an attacker to perform unauthorized administrative actions.

Vulnerability Details

CVE-ID: CVE-2026-57655

Affected Software: Jay Child Theme Wizard

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is an unauthenticated Cross-Site Request Forgery (CSRF) flaw. It allows an attacker to trick an authenticated user into executing unwanted actions within the web application without their knowledge.

Business Impact

The exploitation of this vulnerability could lead to unauthorized configuration changes or administrative actions within the WordPress environment. Given the CVSS score of 8.2, this is a High severity issue that poses a significant risk to site integrity and could be leveraged to facilitate further compromise of the web application.

Remediation Plan

Immediate Action: Identify if the Child Theme Wizard plugin is currently in use and restrict access or disable the plugin until a security patch is verified and applied.

Proactive Monitoring: Review web server access logs for anomalous requests or unexpected administrative changes originating from known user sessions.

Compensating Controls: Implement a Web Application Firewall (WAF) with robust CSRF protection rules to block suspicious requests targeting plugin-specific endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The presence of an unauthenticated CSRF vulnerability in a site management plugin presents a substantial risk to organizational security. Administrators should prioritize updating the component to a patched version as soon as it becomes available and audit current administrative logs for any signs of unauthorized activity.

---METADATA---
VENDOR: WP Job Portal
PRODUCT: WP Job Portal
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An SQL injection vulnerability in the WP Job Portal plugin allows authenticated contributors to execute arbitrary database queries.

Executive Summary:
The WP Job Portal plugin contains an authenticated SQL injection vulnerability that could allow attackers with contributor access to compromise the integrity and confidentiality of the application database.

Vulnerability Details

CVE-ID: CVE-2026-57653

Affected Software: WP Job Portal

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin fails to properly sanitize user-supplied input, enabling a contributor-level user to perform SQL injection. By injecting malicious queries, an attacker can interact directly with the database backend.

Business Impact

The ability to perform unauthorized database operations represents a severe threat to business continuity and data privacy. Given the CVSS score of 8.5, this vulnerability could be leveraged to dump sensitive user data or escalate privileges within the WordPress environment.

Remediation Plan

Immediate Action: Apply the latest security update from the vendor immediately to patch the affected code paths.

Proactive Monitoring: Monitor server logs for suspicious database query activity, specifically focusing on requests originating from contributor-level accounts.

Compensating Controls: Implement WAF rules to sanitize or block requests containing suspicious SQL syntax directed at the plugin's endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high severity of this vulnerability, immediate remediation is required to prevent potential data compromise. Administrators should verify their current version and apply patches as soon as they are made available by the vendor.

---METADATA---
VENDOR: MotoPress
PRODUCT: Restaurant Menu
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A SQL injection vulnerability exists in the Restaurant Menu by MotoPress plugin, allowing authenticated contributors to execute arbitrary SQL commands.

Executive Summary:
The Restaurant Menu plugin for WordPress is vulnerable to an authenticated SQL injection, posing a significant risk of unauthorized database access and data exfiltration.

Vulnerability Details

CVE-ID: CVE-2026-57644

Affected Software: MotoPress Restaurant Menu

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is an SQL injection flaw that resides in the plugin's database query handling, specifically reachable by users with Contributor-level privileges. An attacker can manipulate input parameters to execute unauthorized commands against the underlying database.

Business Impact

Successful exploitation allows an attacker to bypass security controls, extract sensitive information, or potentially modify site content. With a CVSS score of 8.5, this high-severity flaw carries a substantial risk of data breach and loss of site integrity, potentially leading to long-term reputational damage.

Remediation Plan

Immediate Action: Update the Restaurant Menu plugin to the latest version provided by MotoPress as soon as a patch becomes available.

Proactive Monitoring: Review database error logs and query logs for unusual patterns or syntax that indicate attempted SQL injection attacks.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection patterns targeting WordPress plugins.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The high CVSS score of 8.5 underscores the critical nature of this vulnerability. Organizations using this plugin should prioritize the application of vendor patches immediately upon release to mitigate the risk of unauthorized database manipulation.

---METADATA---
VENDOR: Tomdever
PRODUCT: wpForo Forum
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the wpForo Forum plugin allows authenticated contributors to execute arbitrary database queries.

Executive Summary:
The wpForo Forum plugin contains a critical SQL injection vulnerability that allows authenticated contributors to execute malicious database queries, potentially leading to full site compromise.

Vulnerability Details

CVE-ID: CVE-2026-57636

Affected Software: Tomdever wpForo Forum

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a SQL injection vulnerability within the wpForo Forum plugin, triggered by insufficient sanitization of user-supplied input. An attacker with Contributor-level authentication can exploit this flaw to manipulate database queries.

Business Impact

The exploitation of this vulnerability poses a significant risk to data integrity and confidentiality. With a CVSS score of 8.5, this high-severity flaw could allow an attacker to bypass authentication, exfiltrate sensitive user data, or modify administrative settings, resulting in severe reputational damage and potential system downtime.

Remediation Plan

Immediate Action: Update the wpForo Forum plugin to the latest version as soon as a patch is released by the vendor.

Proactive Monitoring: Review database access logs for anomalous, non-standard SQL queries or suspicious patterns originating from Contributor-level accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score, this vulnerability represents a significant risk to the security of the WordPress instance. Administrators are strongly advised to audit user permissions and restrict access to the affected plugin functions until a vendor-supplied patch is successfully applied.

---METADATA---
VENDOR: Soflyy
PRODUCT: WP All Import
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A SQL injection vulnerability exists in the WP All Import plugin that can be exploited by an authenticated administrator to execute arbitrary database queries.

Executive Summary:
An authenticated SQL injection vulnerability in the WP All Import plugin allows an attacker with administrator privileges to manipulate the underlying database and compromise site integrity.

Vulnerability Details

CVE-ID: CVE-2026-57628

Affected Software: Soflyy WP All Import

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a SQL injection flaw where the application fails to properly sanitize input, allowing an authenticated administrator to inject malicious SQL commands into the database.

Business Impact

Successful exploitation allows an attacker to gain unauthorized access to sensitive data, modify database contents, or potentially achieve full site takeover. While requiring administrative access, the CVSS score of 7.6 indicates a high severity, as it facilitates significant escalation of privilege and data exfiltration within the WordPress environment.

Remediation Plan

Immediate Action: Update the WP All Import plugin to the latest version provided by the vendor to ensure all SQL queries are properly parameterized.

Proactive Monitoring: Enable database query logging to identify and audit suspicious or unauthorized SQL statements executing within the WordPress environment.

Compensating Controls: Implement strict database access controls and ensure the database user account used by the web application adheres to the principle of least privilege.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should audit their current plugin installations and apply available security updates immediately. Furthermore, ensure that administrative access to the WordPress dashboard is restricted to trusted personnel to mitigate the risk of this and similar authenticated vulnerabilities.

---METADATA---
VENDOR: Creative Themes
PRODUCT: Blocksy Companion Pro
AFFECTED_VERSIONS: <= 2
---END_METADATA---

Description Summary:
A vulnerability in the Blocksy Companion Pro WordPress plugin allows authenticated contributors to execute arbitrary code on the server.

Executive Summary:
Blocksy Companion Pro versions 2 and below are vulnerable to a Remote Code Execution (RCE) flaw that allows authenticated contributors to gain full system control.

Vulnerability Details

CVE-ID: CVE-2026-57315

Affected Software: Creative Themes Blocksy Companion Pro

Affected Versions: <= 2

Vulnerability: The vulnerability is a Remote Code Execution (RCE) flaw specifically accessible to users with the "Contributor" role. By exploiting insufficient input validation or authorization checks within the plugin, an attacker can execute arbitrary commands on the underlying web server.

Business Impact

This vulnerability carries a CVSS score of 8.5, indicating a high risk of total server compromise. If exploited, an attacker could gain full administrative access to the WordPress environment, leading to data exfiltration, site defacement, or the deployment of persistent backdoors, which would cause significant reputational and operational damage.

Remediation Plan

Immediate Action: Update the Blocksy Companion Pro plugin to the latest available version immediately.

Proactive Monitoring: Review WordPress user access logs for suspicious activity originating from accounts with Contributor-level privileges.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block suspicious requests targeting plugin-specific administrative functions, and consider disabling the plugin until a patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high severity and the nature of RCE, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is critical for any organization hosting WordPress sites using Blocksy Companion Pro. Organizations should immediately audit their WordPress user roles to ensure no unauthorized accounts have Contributor access and apply the update as soon as it is available to neutralize the RCE risk.

---METADATA---
VENDOR: MoreConvert
PRODUCT: MoreConvert Pro Plugin for WordPress
AFFECTED_VERSIONS: Up to and including 1.9.14
---END_METADATA---

Description Summary:
An authentication bypass vulnerability in MoreConvert Pro for WordPress allows unauthenticated attackers to hijack administrator accounts by manipulating email verification tokens.

Executive Summary:
A critical authentication bypass in the MoreConvert Pro plugin allows unauthenticated attackers to hijack existing user accounts, including those with administrative privileges.

Vulnerability Details

CVE-ID: CVE-2026-5722

Affected Software: MoreConvert Pro Plugin for WordPress

Affected Versions: Up to and including 1.9.14

Vulnerability: The vulnerability exists in the guest waitlist verification process, which fails to invalidate tokens when an email address is updated. An attacker can associate their own email with a target account's verification token, effectively gaining unauthorized access to the victim's session.

Business Impact

Successful exploitation results in full account takeover. If an administrator's account is targeted, the attacker gains complete control over the WordPress instance, leading to data breaches, site defacement, and potential compromise of the entire web server. The CVSS score of 9.8 reflects the extreme risk posed by this privilege escalation flaw.

Remediation Plan

Immediate Action: Update the MoreConvert Pro plugin to the latest version to ensure proper token invalidation during email changes.

Proactive Monitoring: Review user account modification logs for suspicious activity and monitor for unexpected changes to administrative user emails.

Compensating Controls: Implement multi-factor authentication (MFA) for all administrative accounts to prevent unauthorized access even if the session is hijacked.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 5, 2026, there is no public information indicating active exploitation of this vulnerability. Nonetheless, the ability to bypass authentication and gain administrative control makes this a high-risk issue.

Analyst Recommendation

Account takeover vulnerabilities are critical risks. Security teams must prioritize updating the affected plugin and should also perform a forensic review of account changes to identify any potential past unauthorized access attempts.

---METADATA---
VENDOR: ThemeHunk
PRODUCT: Advance Product Search
AFFECTED_VERSIONS: <= 1.4.4
---END_METADATA---

Description Summary:
The Advance Product Search plugin for WordPress is susceptible to an unauthenticated SQL injection vulnerability in versions 1.4.4 and earlier.

Executive Summary:
ThemeHunk Advance Product Search contains a critical unauthenticated SQL injection vulnerability that allows remote attackers to compromise the application database.

Vulnerability Details

CVE-ID: CVE-2026-56070

Affected Software: ThemeHunk Advance Product Search

Affected Versions: <= 1.4.4

Vulnerability: This vulnerability involves an unauthenticated SQL injection flaw within the plugin’s search functionality. Attackers can leverage this to execute malicious SQL queries, bypassing authentication requirements and interacting directly with the site's database.

Business Impact

A CVSS score of 9.3 confirms the critical severity of this issue, as it allows for unauthorized data access, modification, or deletion without requiring any user credentials. Successful exploitation could lead to significant business disruption, theft of sensitive product or user information, and long-term reputational damage to the organization.

Remediation Plan

Immediate Action: Update the ThemeHunk Advance Product Search plugin to the latest version provided by the vendor.

Proactive Monitoring: Monitor database query logs for anomalous activity or unexpected database errors that may indicate an ongoing injection attempt.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect and block incoming HTTP requests containing suspicious SQL injection patterns, providing temporary protection until the patch is applied.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Jun 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should treat this vulnerability with the highest priority due to the ease of exploitability and the potential impact on data integrity. It is imperative to update the plugin immediately and audit the database for any signs of unauthorized modification that may have occurred prior to the update.

---METADATA---
VENDOR: Crocoblock
PRODUCT: JetEngine
AFFECTED_VERSIONS: <= 3.8.10.2
---END_METADATA---

Description Summary:
JetEngine versions 3.8.10.2 and earlier are vulnerable to an unauthenticated SQL injection, potentially allowing remote attackers to manipulate database queries.

Executive Summary:
Crocoblock JetEngine is affected by a critical unauthenticated SQL injection vulnerability that poses a severe risk of unauthorized database access and data exfiltration.

Vulnerability Details

CVE-ID: CVE-2026-56068

Affected Software: Crocoblock JetEngine

Affected Versions: <= 3.8.10.2

Vulnerability: This is an unauthenticated SQL injection vulnerability occurring within the JetEngine plugin. An attacker can execute arbitrary SQL commands without prior authentication, directly compromising the integrity and confidentiality of the underlying WordPress database.

Business Impact

The ability for an unauthenticated user to inject arbitrary SQL queries presents a catastrophic risk to the organization, including full database compromise, unauthorized data exfiltration, and potential administrative account takeover. With a CVSS score of 9.3, this vulnerability is classified as critical, necessitating immediate attention to prevent total system compromise and loss of sensitive customer or corporate data.

Remediation Plan

Immediate Action: Update the Crocoblock JetEngine plugin to the latest available version immediately to patch the injection flaw.

Proactive Monitoring: Review web server and database logs for suspicious SQL syntax, such as UNION SELECT statements or unexpected characters originating from external IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust SQL injection filtering rules to block malicious payloads targeting this plugin while the update process is underway.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Jun 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this unauthenticated SQL injection, organizations must prioritize patching JetEngine across all WordPress instances. Failure to remediate this vulnerability exposes the entire database environment to unauthorized access and manipulation, potentially leading to irreparable data loss or regulatory non-compliance.

---METADATA---
VENDOR: bPlugins
PRODUCT: MailChimp Block
AFFECTED_VERSIONS: <= 1
---END_METADATA---

Description Summary:
An unauthenticated broken access control vulnerability in the MailChimp Block plugin allows unauthorized users to perform sensitive actions without appropriate permissions.

Executive Summary:
The bPlugins MailChimp Block plugin contains an unauthenticated broken access control vulnerability that permits unauthorized users to bypass security restrictions.

Vulnerability Details

CVE-ID: CVE-2026-56063

Affected Software: bPlugins MailChimp Block

Affected Versions: <= 1

Vulnerability: This vulnerability is identified as a broken access control flaw that does not require authentication. An attacker can leverage this to perform actions within the MailChimp Block plugin that should be restricted to authorized administrators.

Business Impact

This vulnerability carries a CVSS score of 8.3, indicating a critical risk to WordPress environments. Unauthorized access to plugin functionality can lead to the exposure of mailing list data, unauthorized modification of subscription forms, or potential cross-site scripting (XSS) opportunities if the plugin interfaces with the backend.

Remediation Plan

Immediate Action: Update the MailChimp Block plugin to the latest version immediately to resolve the access control deficiency.

Proactive Monitoring: Review WordPress access logs for unusual administrative activity or unauthorized requests directed at the plugin’s endpoints.

Compensating Controls: Utilize a Web Application Firewall (WAF) to block suspicious requests targeting plugin-specific file paths or parameters until the update is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw as an unauthenticated access control bypass, the potential for exploitation is high.

Analyst Recommendation

The absence of an authentication requirement significantly elevates the risk profile of this vulnerability. Administrators must treat this as a high-priority update to prevent potential data harvesting or site manipulation by remote, unauthenticated threat actors.

---METADATA---
VENDOR: PhysCode
PRODUCT: Travel Booking
AFFECTED_VERSIONS: <= 2.2.5
---END_METADATA---

Description Summary:
The Travel Booking WordPress plugin contains an arbitrary file upload vulnerability exploitable by authenticated subscribers.

Executive Summary:
A critical arbitrary file upload flaw in the PhysCode Travel Booking plugin allows authenticated subscribers to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-56059

Affected Software: PhysCode Travel Booking

Affected Versions: <= 2.2.5

Vulnerability: This vulnerability allows an authenticated user with subscriber-level permissions to bypass file type restrictions, facilitating the upload and execution of arbitrary code on the server.

Business Impact

The ability for a low-privileged user to execute arbitrary code poses a critical risk to the confidentiality and integrity of the application. With a CVSS score of 9.9, this vulnerability could be exploited to gain persistent access, steal customer booking data, or redirect traffic, causing significant reputational and financial harm.

Remediation Plan

Immediate Action: Apply the latest vendor-supplied patch to the Travel Booking plugin to address the file upload validation flaw.

Proactive Monitoring: Monitor server activity for any unexpected file uploads or unauthorized modifications to the web root directory.

Compensating Controls: Use a WAF to inspect and block malicious file upload attempts, and consider disabling file upload features in the plugin until an update is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Urgent remediation is required to mitigate this risk. Administrators should update the Travel Booking plugin immediately and audit existing subscriber accounts to ensure no malicious activity has already occurred within the environment.

---METADATA---
VENDOR: ThemeCatcher
PRODUCT: Quform
AFFECTED_VERSIONS: <= 2.23.0
---END_METADATA---

Description Summary:
The Quform WordPress plugin is susceptible to an arbitrary file upload vulnerability exploitable by authenticated subscribers.

Executive Summary:
A critical arbitrary file upload vulnerability in the ThemeCatcher Quform plugin allows authenticated subscribers to execute arbitrary code on the host server.

Vulnerability Details

CVE-ID: CVE-2026-56058

Affected Software: ThemeCatcher Quform

Affected Versions: <= 2.23.0

Vulnerability: The vulnerability stems from improper input validation during the file upload process, which can be leveraged by a user with the 'subscriber' role to bypass security controls and upload malicious files.

Business Impact

While this vulnerability requires a subscriber-level account, the impact remains severe as it facilitates privilege escalation and Remote Code Execution. With a CVSS score of 9.9, the risk of a compromised account turning into a full server takeover is significant, potentially leading to widespread data loss or service disruption.

Remediation Plan

Immediate Action: Update the Quform plugin to the latest available version to enforce proper file validation and access control.

Proactive Monitoring: Audit user account activity and monitor the web server for the presence of unauthorized files or scripts uploaded via the plugin.

Compensating Controls: Restrict file upload capabilities for low-privileged users via security plugins or WAF configurations until the software update is completed.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should immediately identify all instances of the Quform plugin and ensure they are updated to the patched version. Given that this can be exploited by subscribers, organizations should also review their user registration policies to minimize the potential attack surface.

---METADATA---
VENDOR: Post Snippets (Plugin Developer)
PRODUCT: Post Snippets
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A Remote Code Execution vulnerability exists in the Post Snippets plugin, allowing authenticated contributors to execute arbitrary code on the underlying server.

Executive Summary:
A high-severity Remote Code Execution vulnerability in the Post Snippets plugin allows authenticated contributors to compromise the host server.

Vulnerability Details

CVE-ID: CVE-2026-56049

Affected Software: Post Snippets

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability involves a flaw in the Post Snippets plugin that permits users with the "Contributor" role to perform Remote Code Execution. The issue stems from insufficient input validation or capability enforcement regarding the execution of snippets within the application.

Business Impact

The ability for an authenticated contributor to execute arbitrary code represents a critical security failure, potentially leading to a full system compromise. With a CVSS score of 8.5, this vulnerability could allow attackers to gain unauthorized access to sensitive data, modify website content, or pivot into the broader internal network.

Remediation Plan

Immediate Action: Audit all user accounts with "Contributor" privileges and disable the Post Snippets plugin until a verified security patch is applied.

Proactive Monitoring: Review web server access logs and WordPress audit logs for suspicious execution patterns or unauthorized file modifications.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block suspicious requests directed at the plugin’s execution endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the severe impact of Remote Code Execution, organizations should treat this vulnerability with the highest urgency. Immediately restrict contributor access and monitor for any signs of unauthorized activity while awaiting vendor-supplied updates.

---METADATA---
VENDOR: Themify
PRODUCT: Themify Popup
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A deserialization of untrusted data vulnerability in the Themify Popup plugin allows for remote object injection, potentially leading to arbitrary code execution.

Executive Summary:
A critical object injection vulnerability in the Themify Popup plugin presents a high risk of unauthorized code execution on affected WordPress installations.

Vulnerability Details

CVE-ID: CVE-2026-56037

Affected Software: Themify Themify Popup

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin fails to properly sanitize user-supplied input before deserialization. This flaw allows an attacker to inject malicious objects, which can be leveraged to execute arbitrary code within the context of the web server.

Business Impact

The exploitation of this vulnerability carries a high business risk, as a successful attack could lead to a full compromise of the web server, data exfiltration, or site defacement. With a CVSS score of 8.8, this flaw represents a significant threat to organizational integrity and data confidentiality.

Remediation Plan

Immediate Action: Identify all instances of the Themify Popup plugin and update to the latest available version provided by the vendor.

Proactive Monitoring: Review web server access logs for suspicious serialized strings or unusual post requests directed toward the plugin’s endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious object injection patterns and suspicious serialized data payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the severity of object injection vulnerabilities, organizations should treat this as a high-priority item. Administrators must verify if their environment uses the affected plugin and apply the latest security updates immediately to prevent potential remote code execution.

---METADATA---
VENDOR: Codemstory
PRODUCT: 워드프레스 결제 심플페이 (WordPress Simple Pay)
AFFECTED_VERSIONS: <= 5.5.6
---END_METADATA---

Description Summary:
An unauthenticated SQL injection vulnerability exists in the Codemstory 워드프레스 결제 심플페이 plugin, allowing remote attackers to execute arbitrary database queries.

Executive Summary:
The Codemstory 워드프레스 결제 심플페이 plugin contains a critical SQL injection vulnerability that allows unauthenticated attackers to compromise sensitive database information.

Vulnerability Details

CVE-ID: CVE-2026-56036

Affected Software: Codemstory 워드프레스 결제 심플페이

Affected Versions: <= 5.5.6

Vulnerability: This is an unauthenticated SQL injection vulnerability where the plugin fails to sanitize user-supplied input before including it in database queries. An attacker can craft malicious requests to extract, modify, or delete data from the WordPress database without requiring any authentication.

Business Impact

A successful exploit poses a severe risk to data integrity and confidentiality, potentially leading to a full database compromise. With a CVSS score of 9.3, this flaw is categorized as critical, as it allows attackers to bypass standard access controls to exfiltrate customer payment information or administrative credentials.

Remediation Plan

Immediate Action: Update the 워드프레스 결제 심플페이 plugin to the latest available version provided by Codemstory.

Proactive Monitoring: Review web server and database logs for anomalous SQL syntax, such as UNION statements or unexpected character patterns, originating from unauthenticated sessions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection payloads targeting WordPress plugins.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this SQL injection vulnerability, immediate patching is required to prevent unauthorized database access. Administrators should prioritize updating the plugin across all affected WordPress environments to mitigate the risk of data exfiltration.

---METADATA---
VENDOR: Paytium
PRODUCT: Paytium
AFFECTED_VERSIONS: <= 5.0.2
---END_METADATA---

Description Summary:
A critical unauthenticated privilege escalation vulnerability in the Paytium plugin allows remote attackers to gain unauthorized administrative privileges.

Executive Summary:
The Paytium plugin for WordPress contains an unauthenticated privilege escalation vulnerability that grants attackers full administrative control over the affected site.

Vulnerability Details

CVE-ID: CVE-2026-56030

Affected Software: Paytium Paytium

Affected Versions: <= 5.0.2

Vulnerability: The vulnerability exists due to improper validation of user privileges, enabling an unauthenticated attacker to manipulate plugin functions to escalate their account status to administrator.

Business Impact

A CVSS score of 9.8 underscores the severity of this issue, as it allows for complete unauthorized access to payment-related data and site settings. Successful exploitation could result in significant financial and reputational damage, particularly given the plugin's role in handling payment transactions.

Remediation Plan

Immediate Action: Apply the latest security update provided by Paytium to address the privilege escalation vulnerability.

Proactive Monitoring: Monitor user account activity and audit logs for any unauthorized administrative account creation or unexpected changes to user roles.

Compensating Controls: Ensure a robust WAF is active to filter malicious traffic and block requests targeting known vulnerable plugin interfaces.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents an unacceptable risk to business continuity and data security. Organizations utilizing Paytium must treat this update with the highest priority, ensuring all affected instances are patched immediately to mitigate the threat of unauthorized administrative takeover.

---METADATA---
VENDOR: Themewant
PRODUCT: Easy Elements for Elementor
AFFECTED_VERSIONS: <= 1.4.9
---END_METADATA---

Description Summary:
A critical unauthenticated privilege escalation vulnerability exists in the Easy Elements for Elementor plugin, allowing attackers to elevate their access level without authorization.

Executive Summary:
The Easy Elements for Elementor plugin is vulnerable to an unauthenticated privilege escalation flaw, posing a critical risk of total site compromise.

Vulnerability Details

CVE-ID: CVE-2026-56028

Affected Software: Themewant Easy Elements for Elementor

Affected Versions: <= 1.4.9

Vulnerability: This vulnerability involves a flaw in the plugin's access control mechanisms, allowing an unauthenticated attacker to escalate privileges to an administrative level.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical risk to business operations. An attacker successfully exploiting this flaw could gain full administrative control over the WordPress environment, leading to data exfiltration, unauthorized site modification, or complete system takeover.

Remediation Plan

Immediate Action: Update the Easy Elements for Elementor plugin to the latest available version immediately to patch the authentication bypass.

Proactive Monitoring: Review web server access logs for suspicious POST requests targeting plugin-specific endpoints or unusual user account creation events.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized requests attempting to modify user roles or privilege settings.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical severity and the ease of exploitation for unauthenticated attackers, immediate remediation is mandatory. Administrators should prioritize updating the plugin across all affected WordPress installations to prevent unauthorized administrative access and potential data breaches.

---METADATA---
VENDOR: Pluggabl
PRODUCT: Booster for WooCommerce
AFFECTED_VERSIONS: <= 8.0.1
---END_METADATA---

Description Summary:
Booster for WooCommerce contains an arbitrary file upload vulnerability allowing unauthenticated remote code execution.

Executive Summary:
A critical arbitrary file upload vulnerability in the Pluggabl Booster for WooCommerce plugin poses a severe risk of full site compromise to affected WordPress environments.

Vulnerability Details

CVE-ID: CVE-2026-56027

Affected Software: Pluggabl Booster for WooCommerce

Affected Versions: <= 8.0.1

Vulnerability: This flaw exists due to insufficient validation of file uploads, allowing an unauthenticated attacker to upload and execute arbitrary malicious scripts on the underlying server.

Business Impact

Successful exploitation of this vulnerability allows an attacker to achieve Remote Code Execution (RCE), leading to full site takeover, data exfiltration, and potential lateral movement within the hosting environment. Given the CVSS score of 9.9, this represents a critical threat to business continuity and data integrity, necessitating immediate intervention.

Remediation Plan

Immediate Action: Upgrade to the latest version of the Booster for WooCommerce plugin immediately to patch the insecure file handling mechanism.

Proactive Monitoring: Review web server logs for suspicious POST requests targeting upload directories or unexpected execution of files with non-standard extensions.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to restrict file uploads and block access to sensitive directories until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it provides a direct vector for total system compromise. Administrators must prioritize updating the plugin across all affected WordPress installations to close this critical security gap and prevent unauthorized access.

---METADATA---
VENDOR: Tyche
PRODUCT: Abandoned Cart Pro for WooCommerce
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A privilege escalation vulnerability in Abandoned Cart Pro for WooCommerce allows a subscriber-level user to escalate their privileges to administrative access.

Executive Summary:
The Abandoned Cart Pro for WooCommerce plugin contains a critical privilege escalation flaw that allows authenticated subscribers to gain unauthorized administrative control over the WordPress site.

Vulnerability Details

CVE-ID: CVE-2026-56010

Affected Software: Tyche Abandoned Cart Pro for WooCommerce

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves an improper capability check, allowing an authenticated user with "subscriber" permissions to perform actions restricted to administrative roles. The flaw resides in the plugin's handling of user permission validation.

Business Impact

A successful exploitation of this vulnerability grants an attacker full administrative access to the WordPress environment. This risk, justified by the 8.8 CVSS score, could lead to complete site compromise, data exfiltration, and the execution of arbitrary code, resulting in severe reputational and operational damage.

Remediation Plan

Immediate Action: Update the Abandoned Cart Pro for WooCommerce plugin to the latest patched version provided by Tyche.

Proactive Monitoring: Audit user account activity for any unexpected administrative actions or newly created high-privilege accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block suspicious requests targeting WordPress administrative endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score of 8.8, immediate remediation is required to secure the integrity of the affected WordPress instance. Administrators should prioritize updating the plugin and conducting a thorough review of existing user accounts to identify potential unauthorized privilege changes.

---METADATA---
VENDOR: ThemeFusion
PRODUCT: Fusion Builder
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A privilege escalation vulnerability in ThemeFusion's Fusion Builder allows users with Contributor roles to perform unauthorized actions.

Executive Summary:
A critical privilege escalation vulnerability in Fusion Builder allows low-privileged users to perform unauthorized actions, potentially leading to full site compromise.

Vulnerability Details

CVE-ID: CVE-2026-56008

Affected Software: ThemeFusion Fusion Builder

Affected Versions: See vendor advisory for affected versions

Vulnerability: This is a privilege escalation vulnerability where a user with the Contributor role can exploit the Fusion Builder plugin to perform actions outside their designated capabilities. This flaw exposes the application to unauthorized content manipulation and potential administrative takeover.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe threat to the integrity and security of the hosting WordPress environment. Successful exploitation could allow an attacker to modify site content, inject malicious scripts, or obtain administrative control, leading to reputational damage and potential loss of site availability.

Remediation Plan

Immediate Action: Update the Fusion Builder plugin to the latest patched version immediately.

Proactive Monitoring: Review user accounts and permissions, specifically auditing the activity of users with the "Contributor" role for suspicious behavior.

Compensating Controls: Temporarily disable the Fusion Builder plugin if updates cannot be applied, or restrict access to the WordPress administrative dashboard to authorized IP addresses.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Privilege escalation flaws in plugins are common targets for attackers seeking to gain a foothold in web applications. Administrators are strongly advised to verify their current version of Fusion Builder and apply the necessary updates to mitigate the risk of unauthorized administrative access and potential site-wide compromise.

---METADATA---
VENDOR: Divi Engine
PRODUCT: Divi Form Builder
AFFECTED_VERSIONS: Up to and including 5.1.8
---END_METADATA---

Description Summary:
The Divi Form Builder plugin for WordPress contains an arbitrary file upload vulnerability allowing unauthenticated remote code execution via insufficient file extension validation.

Executive Summary:
The Divi Form Builder plugin for WordPress is vulnerable to unauthenticated remote code execution, posing a critical risk of total site compromise.

Vulnerability Details

CVE-ID: CVE-2026-5524

Affected Software: Divi Engine Divi Form Builder

Affected Versions: Up to and including 5.1.8

Vulnerability: This vulnerability stems from inadequate validation in the do_image_upload() function, where attackers can bypass existing filters to upload executable PHP files. This flaw allows unauthenticated attackers to execute arbitrary code on the underlying web server.

Business Impact

Successful exploitation of this vulnerability grants an attacker full control over the WordPress installation and potentially the underlying web server. Given the CVSS score of 9.8, this represents a critical risk of data exfiltration, site defacement, and the deployment of persistent backdoors, leading to severe reputational and operational damage.

Remediation Plan

Immediate Action: Update the Divi Form Builder plugin to the latest available version immediately to implement robust file extension filtering.

Proactive Monitoring: Review access logs for requests to the /wp-content/uploads/de_fb_uploads/ directory, specifically looking for files with .php, .phtml, or .phar extensions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized file uploads and restrict direct execution of scripts within the uploads directory.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly severe because it allows unauthenticated attackers to gain code execution with minimal effort. Organizations must prioritize updating the plugin to the latest version to close the upload bypass vector. If an immediate update is not feasible, restrict direct access to the uploads directory via server configuration until patching is complete.

---METADATA---
VENDOR: Bookly
PRODUCT: Online Scheduling and Appointment Booking System
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'bookly-customer-full-name' cookie.

Executive Summary:
The Bookly plugin for WordPress contains a Stored Cross-Site Scripting vulnerability that could allow unauthenticated attackers to execute malicious scripts in a user's browser.

Vulnerability Details

CVE-ID: CVE-2026-5513

Affected Software: Bookly Online Scheduling and Appointment Booking System

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a Stored XSS vulnerability located within the 'bookly-customer-full-name' cookie parameter. The flaw allows an unauthenticated attacker to inject arbitrary client-side scripts that execute when a victim views the affected data.

Business Impact

Successful exploitation allows attackers to steal sensitive session cookies, perform unauthorized actions on behalf of administrators, or redirect users to malicious sites. Given the CVSS score of 7.2, this high-severity flaw poses a significant risk to the integrity and confidentiality of WordPress site management.

Remediation Plan

Immediate Action: Update the Bookly plugin to the latest available version provided by the vendor to ensure the vulnerability is patched.

Proactive Monitoring: Review web server and application logs for suspicious characters or script tags originating from booking-related cookies.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust XSS filtering rules to inspect and sanitize incoming cookie data.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should prioritize updating the Bookly plugin immediately. Failure to address this vulnerability could lead to site-wide compromise through administrative account takeover.

---METADATA---
VENDOR: Premmerce
PRODUCT: Wishlist for WooCommerce
AFFECTED_VERSIONS: <= 1.1.11
---END_METADATA---

Description Summary:
Premmerce Wishlist for WooCommerce contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries.

Executive Summary:
A critical unauthenticated SQL injection vulnerability in Premmerce Wishlist for WooCommerce poses a severe risk of full database compromise.

Vulnerability Details

CVE-ID: CVE-2026-54849

Affected Software: Premmerce Wishlist for WooCommerce

Affected Versions: <= 1.1.11

Vulnerability: This is an SQL injection vulnerability occurring in the plugin's data processing logic. An unauthenticated remote attacker can inject malicious SQL commands to bypass security controls and access sensitive data.

Business Impact

The ability for an unauthenticated user to execute arbitrary SQL queries represents a critical threat to business operations. Successful exploitation could lead to the total exfiltration of customer data, unauthorized administrative access, or complete site takeover, justifying the 9.3 CVSS score.

Remediation Plan

Immediate Action: Update the Premmerce Wishlist for WooCommerce plugin to the latest available version immediately to patch the injection vector.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, specifically those containing SQL syntax characters or unexpected union-based requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection patterns targeting WordPress plugins.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of unauthenticated SQL injection, immediate patching is required to prevent unauthorized data access. Security teams should prioritize this update across all affected WordPress environments to mitigate the risk of a high-impact breach.

---METADATA---
VENDOR: PluginUs.Net
PRODUCT: MDTF
AFFECTED_VERSIONS: <= 1.3.7
---END_METADATA---

Description Summary:
The MDTF plugin for WordPress contains an unauthenticated SQL injection vulnerability in versions 1.3.7 and earlier, allowing remote attackers to execute arbitrary database commands.

Executive Summary:
An unauthenticated SQL injection vulnerability in the MDTF plugin enables remote attackers to execute arbitrary database queries, risking full site compromise and sensitive data exposure.

Vulnerability Details

CVE-ID: CVE-2026-54843

Affected Software: PluginUs.Net MDTF

Affected Versions: <= 1.3.7

Vulnerability: This is a classic SQL injection vulnerability where the application fails to properly sanitize user-supplied input before including it in database queries. Because it is unauthenticated, any remote attacker can interact with the database without needing valid credentials.

Business Impact

A CVSS score of 9.3 highlights the extreme severity of this flaw. Successful exploitation allows for unauthorized access to the entire WordPress database, potentially leading to the theft of customer data, administrative account hijacking, or the deployment of malicious content, causing severe reputational and financial damage.

Remediation Plan

Immediate Action: Update the MDTF plugin to the latest available version provided by PluginUs.Net to remediate the SQL injection flaw.

Proactive Monitoring: Inspect database query logs for unusual or long-running queries and monitor for signs of unauthorized data access or administrative account creation.

Compensating Controls: Utilize a Web Application Firewall (WAF) with established rules for blocking SQL injection patterns to mitigate risks while the update process is scheduled.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

SQL injection is a high-risk vulnerability that requires immediate attention. Security teams must ensure all instances of the MDTF plugin are patched to the latest version to prevent potential remote database compromise.

---METADATA---
VENDOR: Royal Plugins
PRODUCT: Royal MCP
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A missing authorization vulnerability in Royal Plugins' Royal MCP allows attackers to exploit incorrectly configured access control settings.

Executive Summary:
A critical missing authorization vulnerability in the Royal MCP plugin exposes the application to unauthorized configuration changes and potential privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-54842

Affected Software: Royal Plugins Royal MCP

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability stems from a missing capability check, which allows users—potentially including unauthenticated or low-privileged attackers—to interact with functions that should be restricted to administrative roles.

Business Impact

The inability to properly enforce authorization permits unauthorized users to modify plugin settings or access sensitive data, leading to severe reputational damage and potential system takeover. With a CVSS score of 8.1, this represents a significant security oversight that requires immediate attention to prevent unauthorized administrative actions.

Remediation Plan

Immediate Action: Update the Royal MCP plugin to the latest version immediately to ensure that correct authorization checks are implemented.

Proactive Monitoring: Monitor site activity logs for unauthorized administrative actions or modifications to plugin configurations.

Compensating Controls: Disable the Royal MCP plugin until an update is applied and verify that file permissions are set to prevent unauthorized modification of plugin code.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should immediately audit their WordPress or CMS environments for the Royal MCP plugin. Given the risk of unauthorized access, the plugin should be disabled or updated as a matter of urgency to maintain the security integrity of the platform.

---METADATA---
VENDOR: Rymera
PRODUCT: WC Vendors Marketplace
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the WC Vendors Marketplace plugin allows authenticated subscribers to execute arbitrary database queries.

Executive Summary:
The WC Vendors Marketplace plugin is affected by an authenticated SQL injection vulnerability that risks the confidentiality and integrity of the marketplace database.

Vulnerability Details

CVE-ID: CVE-2026-54838

Affected Software: Rymera WC Vendors Marketplace

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is triggered by inadequate input validation within the plugin's code, allowing an authenticated subscriber to inject malicious SQL commands. This flaw permits unauthorized interactions with the database layer of the marketplace.

Business Impact

Exploitation of this vulnerability allows attackers to access, alter, or destroy sensitive marketplace data, including vendor information and transaction records. A CVSS score of 8.5 highlights the severe risk to business continuity and data privacy for organizations utilizing this e-commerce solution.

Remediation Plan

Immediate Action: Apply the latest security patches provided by Rymera for the WC Vendors Marketplace plugin.

Proactive Monitoring: Review database logs for suspicious SQL syntax or abnormal query execution times that may indicate an ongoing attack.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to detect and block common SQL injection patterns targeting WordPress plugin endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators must prioritize updating the plugin to the latest patched version to remediate this vulnerability. Given that the exploit requires authenticated subscriber access, organizations should also review their user registration settings and monitor for suspicious new account activity.

---METADATA---
VENDOR: Jegstudio
PRODUCT: Gutenverse Companion
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A broken access control vulnerability in the Gutenverse Companion plugin allows unauthenticated attackers to bypass security restrictions.

Executive Summary:
The Gutenverse Companion plugin is vulnerable to an unauthenticated access control flaw, posing a significant risk of unauthorized site configuration changes or data exposure.

Vulnerability Details

CVE-ID: CVE-2026-54832

Affected Software: Jegstudio Gutenverse Companion

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability consists of a broken access control flaw within the plugin, which permits unauthenticated remote attackers to perform actions restricted to authorized users. The lack of proper capability checks allows for unauthorized interaction with plugin-specific functions.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized administrative actions, site disruption, or the potential for privilege escalation. Given the CVSS score of 7.5 (High), this represents a significant security risk to the integrity and availability of the WordPress environment hosting this plugin.

Remediation Plan

Immediate Action: Identify if the affected plugin is in use and apply vendor security updates as soon as they are released.

Proactive Monitoring: Monitor web server access logs for anomalous requests targeting plugin-specific files or unexpected administrative actions.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block suspicious traffic patterns targeting the plugin's entry points until a patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should prioritize the assessment of their WordPress environments to determine if the vulnerable Gutenverse Companion plugin is active. Given the severity of unauthenticated access control vulnerabilities, administrators must remain vigilant for vendor patch notifications and apply updates immediately upon availability to mitigate the risk of unauthorized system compromise.

---METADATA---
VENDOR: GeoDirectory
PRODUCT: GeoDirectory
AFFECTED_VERSIONS: <= 2.8.162
---END_METADATA---

Description Summary:
GeoDirectory versions 2.8.162 and earlier are susceptible to an unauthenticated SQL injection vulnerability, enabling database manipulation by remote attackers.

Executive Summary:
The GeoDirectory plugin for WordPress contains a critical unauthenticated SQL injection flaw that permits unauthorized database access and potential data exfiltration.

Vulnerability Details

CVE-ID: CVE-2026-54831

Affected Software: GeoDirectory GeoDirectory

Affected Versions: <= 2.8.162

Vulnerability: This vulnerability is an unauthenticated SQL injection, occurring when user-supplied input is insufficiently sanitized before being processed by the database. No administrative or user login is required to trigger this vulnerability, significantly increasing the attack surface.

Business Impact

An attacker leveraging this flaw can gain unauthorized access to the application’s backend database, leading to the exposure of sensitive user data, configuration details, or credentials. The CVSS score of 9.3 underscores the critical nature of this vulnerability and the high likelihood of severe business impact if left unpatched.

Remediation Plan

Immediate Action: Upgrade the GeoDirectory plugin to the latest available version provided by the vendor.

Proactive Monitoring: Monitor database query performance and audit application logs for suspicious characters or patterns associated with SQL injection probes.

Compensating Controls: Implement WAF filtering to intercept and drop requests containing malicious SQL payloads directed at the GeoDirectory plugin endpoints.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical risk posed by this unauthenticated vulnerability, remediation should be treated as a high-priority task. Organizations utilizing GeoDirectory must ensure they are updated to the secure version to prevent potential compromise of the application environment.

---METADATA---
VENDOR: Contempo
PRODUCT: Real Estate 7
AFFECTED_VERSIONS: <= 3.5.9
---END_METADATA---

Description Summary:
Real Estate 7 contains an unauthenticated SQL injection vulnerability in versions 3.5.9 and earlier, allowing remote attackers to manipulate database queries.

Executive Summary:
The Real Estate 7 WordPress theme is vulnerable to unauthenticated SQL injection, posing a critical risk of full database compromise.

Vulnerability Details

CVE-ID: CVE-2026-54827

Affected Software: Contempo Real Estate 7

Affected Versions: <= 3.5.9

Vulnerability: This flaw involves an unauthenticated SQL injection vulnerability, which allows an attacker to execute arbitrary SQL commands via the application's input parameters. Because the vulnerability does not require authentication, it is accessible to any remote, unauthenticated user.

Business Impact

Successful exploitation of this vulnerability allows an attacker to bypass security controls, extract sensitive site data, or potentially achieve remote code execution on the underlying server. Given the CVSS score of 9.3, this represents a critical threat to data integrity, confidentiality, and overall platform availability.

Remediation Plan

Immediate Action: Update the Contempo Real Estate 7 theme to the latest patched version immediately.

Proactive Monitoring: Review web server and database logs for anomalous SQL syntax, such as UNION SELECT statements or unexpected error codes originating from public-facing inputs.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection patterns targeting the theme's entry points.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The critical severity of this vulnerability necessitates immediate action. Administrators must prioritize updating the Real Estate 7 theme to the version provided by the vendor to eliminate the injection vector and secure the application against unauthorized database access.

---METADATA---
VENDOR: wpDataTables
PRODUCT: wpDataTables
AFFECTED_VERSIONS: <= 7.4
---END_METADATA---

Description Summary:
The wpDataTables plugin for WordPress contains an unauthenticated SQL injection vulnerability that enables remote attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in the wpDataTables plugin poses a critical risk by allowing remote attackers to extract sensitive data from the underlying database.

Vulnerability Details

CVE-ID: CVE-2026-54825

Affected Software: wpDataTables wpDataTables

Affected Versions: <= 7.4

Vulnerability: This is an unauthenticated SQL injection vulnerability, allowing attackers to perform unauthorized database operations without requiring login credentials or specific user capabilities.

Business Impact

With a CVSS score of 9.3, this flaw presents a severe risk to data confidentiality and integrity. Compromise of the database could result in the exposure of personally identifiable information (PII) and unauthorized administrative access, posing significant legal and financial risks to the organization.

Remediation Plan

Immediate Action: Update the wpDataTables plugin to the latest version immediately as recommended by the vendor.

Proactive Monitoring: Review database query logs for suspicious activity, particularly queries originating from unauthenticated sessions that exhibit signs of SQL injection.

Compensating Controls: Utilize a Web Application Firewall (WAF) to intercept and block malicious SQL injection attempts before they reach the plugin's vulnerable parameters.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the ease of exploitability for unauthenticated SQL injections, this vulnerability should be remediated with the highest priority. Administrators must update the plugin immediately and audit systems for any signs of prior unauthorized access.

---METADATA---
VENDOR: WPQuads
PRODUCT: Ads by WPQuads
AFFECTED_VERSIONS: <= 3
---END_METADATA---

Description Summary:
The Ads by WPQuads plugin for WordPress is susceptible to unauthenticated sensitive data exposure due to insufficient access control.

Executive Summary:
An unauthenticated sensitive data exposure vulnerability in the Ads by WPQuads plugin could allow unauthorized access to sensitive configuration information.

Vulnerability Details

CVE-ID: CVE-2026-54824

Affected Software: WPQuads Ads by WPQuads

Affected Versions: <= 3

Vulnerability: The plugin fails to perform adequate capability checks on specific functions, allowing an unauthenticated remote attacker to retrieve sensitive data from the WordPress environment.

Business Impact

The exposure of sensitive configuration data can lead to the compromise of site credentials, advertising API keys, or internal settings. With a CVSS score of 7.5, this vulnerability presents a high risk to the overall security posture and operational integrity of the affected WordPress site.

Remediation Plan

Immediate Action: Update the Ads by WPQuads plugin to the latest version, ensuring the patch for this access control flaw is applied.

Proactive Monitoring: Review web server access logs for anomalous requests targeting plugin-specific files or endpoints that should be restricted to administrators.

Compensating Controls: Utilize a Web Application Firewall (WAF) to block requests containing suspicious patterns or unauthorized access attempts to the vulnerable plugin components.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, vulnerabilities in WordPress plugins are frequently targeted by automated scanners.

Analyst Recommendation

Unauthenticated vulnerabilities in web plugins are highly dangerous as they require no user interaction to exploit. Site administrators must update the plugin immediately and audit their WordPress installations for any signs of unauthorized access or configuration changes.

---METADATA---
VENDOR: Crocoblock
PRODUCT: JetBooking
AFFECTED_VERSIONS: <= 4.0.4.1
---END_METADATA---

Description Summary:
An unauthenticated SQL injection vulnerability in the JetBooking plugin for WordPress allows remote attackers to execute arbitrary SQL queries and access sensitive database information.

Executive Summary:
A critical SQL injection vulnerability in the Crocoblock JetBooking plugin allows unauthenticated attackers to gain unauthorized access to the application database.

Vulnerability Details

CVE-ID: CVE-2026-54820

Affected Software: Crocoblock JetBooking

Affected Versions: <= 4.0.4.1

Vulnerability: This is an unauthenticated SQL injection vulnerability, meaning no user privileges are required for an attacker to manipulate backend database queries through the plugin.

Business Impact

The CVSS score of 9.3 highlights the extreme severity of this flaw. An attacker can bypass authentication, extract sensitive customer or administrative data, and potentially modify or delete database content, leading to severe operational disruption and regulatory non-compliance.

Remediation Plan

Immediate Action: Update the JetBooking plugin to the latest version provided by Crocoblock to remediate the SQL injection flaw.

Proactive Monitoring: Audit database logs for anomalous query patterns, such as unexpected UNION statements or unauthorized access to sensitive tables.

Compensating Controls: Deploy a WAF with rules configured to detect and block common SQL injection patterns targeting WordPress plugins.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

SQL injection remains a primary vector for data breaches. Administrators should treat this vulnerability with high urgency, applying the vendor-supplied patch as soon as possible to protect the integrity and confidentiality of the application database.

---METADATA---
VENDOR: WordPress
PRODUCT: Widgets for Social Photo Feed
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Widgets for Social Photo Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'feed_data' parameter.

Executive Summary:
A Stored Cross-Site Scripting vulnerability in the Widgets for Social Photo Feed plugin allows attackers to inject malicious scripts into the site.

Vulnerability Details

CVE-ID: CVE-2026-5425

Affected Software: WordPress Widgets for Social Photo Feed

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin fails to sanitize the 'feed_data' parameter, allowing for the injection of malicious JavaScript. This script is stored and executed in the browsers of users viewing the site, potentially leading to session hijacking.

Business Impact

With a CVSS score of 7.2, this vulnerability poses a risk of account takeover for administrative users. Attackers could steal session cookies, manipulate site content, or perform actions on behalf of authenticated administrators, leading to further site compromise.

Remediation Plan

Immediate Action: Update the Widgets for Social Photo Feed plugin to the latest version.