Vulnerabilities
WordPress User Registration Plugin Vulnerable to Arbitrary Shortcode Execution
Unauthenticated attackers can inject shortcodes via HTTP headers in the User Registration & Membership plugin versions up to 5.2.8.
WordPress
Everything Vuln Post has reported about WordPress: 9 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
Vulnerabilities
LatePoint WordPress Plugin Race Condition Bypasses OTP Authentication Lockout
Unauthenticated attackers can bypass account lockouts on LatePoint versions through 5.7.4 by exploiting a race condition in the verification process.
Vulnerabilities
WordPress Green Popups 7.6.3 Fixes Critical Blind SQL Injection CVE-2026-94388
WordPress sites using halfdata Green Popups must update to version 7.6.3 to fix a critical blind SQL injection flaw.
Vulnerabilities
SQL Injection in CP Multi View Event Calendar Affects WordPress Sites
A high-severity SQL injection flaw in the CP Multi View Event Calendar plugin affects versions through 1.4.41, with no confirmed patch status in the record.
Vulnerabilities
Abandoned Cart Pro Token Forgery Bug Permits Admin Takeover in Versions Up to 10.8.0
Unauthenticated attackers can hijack any user account, including admins, by forging tokens in Abandoned Cart Pro versions up to 10.8.0.
Vulnerabilities
Printcart Store Plugin Unauthenticated RCE Flaw Affects Versions Through 2.9.1
A critical vulnerability in the Printcart Store WooCommerce plugin allows attackers to execute code remotely without logging in, affecting all versions up to 2.9.1.
Vulnerabilities
Tickera Plugin: Critical Blind SQL Injection in v3.6.0.6 Risks Database Access
Security researchers identified a critical blind SQL injection flaw in Tickera versions up to 3.6.0.6, risking unauthorized database access and data exposure.
Vulnerabilities
Advanced IP Blocker CVE-2026-104732: Unauthenticated TOTP Brute-Force Grants Full WordPress Control
A critical flaw in the Advanced IP Blocker plugin allows unauthenticated attackers to bypass two-factor authentication and seize full control of WordPress sites.
Vulnerabilities
WordPress Convex Plugin Deserialization Vulnerability Requires Immediate Patching for Critical Fix
Security teams must patch WordPress installations running ThemeREX Convex versions through 1.16.0 to close a critical deserialization flaw rated 9.8 by the NVD.