Threat database

The Patreon WordPress plugin versions before 1.10.0 contain a Cross-Site Request Forgery (CSRF) vulnerability. This flaw allows an attacker to trick a logged-in administrator into re-linking the site's Patreon integration to an attacker-controlled account via a crafted request. The vulnerability arises because the plugin does not verify a nonce during the connection process. Exploitation can lead to takeover of the site's Patreon integration.

Contact Form 7 Signature Addon WordPress plugin versions up to 4.2.2 contain a path traversal vulnerability. This flaw allows unauthenticated users to manipulate a signature field to attach arbitrary files from the server's wp-content directory to outgoing emails. If the form is set to email a copy to an address controlled by the submitter, the attacker can read the contents of targeted files. The vulnerability has a medium severity with a CVSS score of 5.9.

CVE-2026-91074 is a SQL injection vulnerability in the BSK PDF Manager WordPress plugin versions up to 3.8.1. The plugin fails to properly sanitize and escape a parameter used in a SQL query, allowing authenticated users with contributor-level access or higher to perform SQL injection attacks. This could lead to unauthorized reading of sensitive data, including administrator password hashes.

This is a research survey investigating burnout, cognitive workload, and alert fatigue among security operations personnel such as SOC analysts, incident responders, and threat hunters. The survey is anonymous and voluntary, aiming to gather data on workplace factors contributing to these issues in security operations centers. There is no indication of a security vulnerability or threat in this content.

The User Registration & Membership plugin for WordPress versions up to and including 5.2.8 contains a code injection vulnerability. This arises from improper sanitization of the HTTP_REFERER header in the 'referrer_url' smart tag processing, allowing unauthenticated attackers to execute arbitrary registered shortcodes on restricted pages using the {{referrer_url}} tag. The vulnerability is classified as CWE-94 and has a high severity with a CVSS score of 8.1.

The EU VAT Assistant for WooCommerce WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the 'vat_number' parameter in all versions up to and including 2.1.30.260413. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute in the administrator's browser when reviewing orders, potentially leading to privilege escalation and full site takeover through rogue administrator account creation.

Themify Popup plugin for WordPress versions up to and including 1.4.7 contains a stored cross-site scripting (XSS) vulnerability via the 'popup_width_unit' parameter. Authenticated users with author-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping.

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses versions up to and including 4.4.10 contain an authorization bypass vulnerability. This flaw allows authenticated users with subscriber-level access or higher to enumerate all site users and extract their full email addresses, including those of administrators, by exploiting improper authorization checks.

The Themify Builder plugin for WordPress up to version 7.8.2 contains a stored cross-site scripting (XSS) vulnerability via the 'visible' shortcode attribute. Authenticated users with contributor-level access or higher can inject malicious scripts into pages, which execute when those pages are viewed. Exploitation requires the 'slider' custom post type to be active, which occurs automatically with certain themes or plugins. The vulnerability arises from insufficient input sanitization and output escaping.

The WP Booking System – Booking Calendar WordPress plugin up to version 2.1.0.3 suffers from an authorization bypass vulnerability. This flaw allows unauthenticated attackers or any subscriber-level user to access stored notification email bodies of bookings by iterating booking and email log IDs. Sensitive customer information such as names, email addresses, phone numbers, messages, and booking dates intended only for administrators can be exposed. The vulnerability arises because the plugin does not properly verify user authorization when performing certain actions.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the wpeverest User Registration & Membership WordPress plugin versions up to and including 5.2.8. The flaw arises from missing or incorrect nonce validation in the trigger_bulk_action function, allowing unauthenticated attackers to trick administrators into approving or denying user registrations. This can result in locking targeted users out of the site. The vulnerability bypasses earlier nonce checks by exploiting an empty new_role parameter, leading to unprotected execution of bulk actions.

The WP Booking System – Booking Calendar WordPress plugin up to version 2.1.0.3 contains an authorization bypass vulnerability. Authenticated users with subscriber-level access or higher can exploit this flaw to grant themselves and others edit access to all booking forms by manipulating the user_permission meta. Exploitation requires prior delegated edit rights on at least one booking form to obtain a valid nonce. This vulnerability allows unauthorized privilege escalation within the plugin's access control.

A stored cross-site scripting (XSS) vulnerability exists in the User Registration & Membership WordPress plugin up to version 5.2.8. The flaw allows unauthenticated attackers to inject malicious scripts via the Checkbox Field Value due to insufficient input sanitization and output escaping. The vulnerability is reachable through an AJAX action that lacks nonce validation, enabling arbitrary script execution when users access the injected content.

LearnPress WordPress plugin versions up to 4.4.10 are vulnerable to PHP Object Injection via deserialization of untrusted input from the 'checkout-email' parameter during checkout AJAX requests. The plugin improperly unserializes data without restricting allowed classes, enabling unauthenticated attackers to inject malicious PHP objects. This vulnerability has a critical severity with a CVSS score of 9.8.

The WP Booking System – Booking Calendar WordPress plugin versions up to and including 2.1.0.3 contain a missing authorization vulnerability. Authenticated users with subscriber-level access or higher can exploit the 'id' parameter to access private booking descriptions and booking IDs from any calendar on the site. This vulnerability leads to sensitive information exposure without impacting data integrity or availability.

Tutor LMS plugin for WordPress versions up to and including 4.1.0 contains an authorization bypass vulnerability via the 'ID' parameter. Authenticated users with author-level access or higher can modify courses created by other instructors by exploiting missing validation on a user-controlled key. This allows overwriting course titles, content, status, and reassigning course ownership.

The Welcart e-Commerce plugin for WordPress contains an SQL Injection vulnerability in the 'wp_usces_order_old' parameter affecting all versions up to and including 2.12.4. Authenticated users with editor-level access or higher can exploit this flaw to append additional SQL queries, potentially extracting sensitive database information. The vulnerability arises from insufficient escaping and lack of proper query preparation. The CVSS score is 4.9, indicating a medium severity risk.

The xSpeed Cache plugin for WordPress up to version 1.4.2 contains a stored cross-site scripting (XSS) vulnerability via the 'content' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping.

The Post Export Import with Media WordPress plugin up to version 1.17.2 contains a directory traversal vulnerability via the 'theme_slug' parameter. This vulnerability allows authenticated users with administrator-level privileges or higher to access files outside the intended directory if the 'peiwm_enable_admin_download_buttons' feature is enabled. The vulnerability has a medium severity rating with a CVSS score of 4.9.

The Appointment Booking Plugin – LatePoint for WordPress versions up to and including 5.7.4 has a vulnerability that allows unauthenticated attackers to access sensitive customer information. This occurs via the 'params (customer[uuid])' parameter through the unauthenticated steps__load_step AJAX endpoint when the plugin is configured in guest checkout mode ('Field used for authentication' set to 'Disable ability to login'). The exposed data includes first name, last name, email address, phone number, and notes of all customer records.