Artus Kg

The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server.

The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subscriber to read the email addresses of the repository's staff.

**Name of the Vulnerable Software and Affected Versions** Portfolio Filter Gallery versions prior to 2.2.1 **Description** Insufficient authorization checks in several AJAX actions allow users with the Contributor role or higher to read, modify, and delete galleries belonging to other users and site-wide gallery filters. **Recommendations** Update Portfolio Filter Gallery to version 2.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** Appointment Booking Plugin WordPress plugin versions prior to 5.6.9 **Description** Insufficient per-record authorization in several AI Abilities API actions allows an authenticated user with the LatePoint Agent role to bypass restrictions. When the Abilities API feature is enabled, an attacker can read and modify profile data of other agents, as well as access bookings and associated customer details belonging to other agents. **Recommendations** Update the Appointment Booking Plugin to version 5.6.9 or later. As a temporary mitigation, disable the Abilities API feature.

**Name of the Vulnerable Software and Affected Versions** Five Star Business Profile and Schema WordPress plugin versions prior to 2.4.0 **Description** Insufficient restriction of callbacks used to resolve schema field default values allows authenticated users with Author-level access and above to store input that discloses sensitive data. This can lead to the exposure of other users' password hashes and arbitrary site option values in public output accessible to unauthenticated visitors. **Recommendations** Update Five Star Business Profile and Schema WordPress plugin to version 2.4.0 or later.

**Name of the Vulnerable Software and Affected Versions** Kubio AI Page Builder WordPress plugin versions prior to 2.9.3 **Description** Insufficient validation of the URI scheme in a user-supplied value allows users with the contributor role and above to store a malicious payload. This payload executes in the browser of any user who follows the link, including administrators previewing unpublished submissions. **Recommendations** Update the plugin to version 2.9.3 or later.

**Name of the Vulnerable Software and Affected Versions** Popup Maker WP WordPress plugin versions prior to 1.4.6 **Description** The plugin fails to perform authorization checks on several actions and exposes its management page to any logged-in user. This allows users with low-privileged roles, such as Subscriber, to store display-targeting values. These values are subsequently invoked as zero-argument PHP callables—functions that can be called without passing any arguments—during public page loads, which can result in sensitive information disclosure and denial of service. **Recommendations** Update the plugin to version 1.4.6 or later.

**Name of the Vulnerable Software and Affected Versions** Request a Quote WordPress plugin versions prior to 2.5.7 **Description** An unauthenticated AJAX handler fails to perform an authorization check, which allows unauthenticated users to read contact records of quote-request submissions. This includes access to records that the site has not published. **Recommendations** Update the plugin to version 2.5.7 or later.

**Name of the Vulnerable Software and Affected Versions** Popup Maker WordPress plugin versions prior to 1.4.6 **Description** The plugin fails to perform a capability check on an account-connection action, relying solely on nonce verification. This allows authenticated users with minimal privileges, such as Subscribers, to overwrite site-wide configuration options, including the linked service account and API configuration, which should be restricted to administrators. **Recommendations** Update the plugin to version 1.4.6 or later.

**Name of the Vulnerable Software and Affected Versions** Paytm Payment Gateway WordPress plugin versions prior to 2.8.9 **Description** When the secret key is not configured, which occurs immediately after activation, the plugin fails to verify that payment callbacks originate from the legitimate payment provider. This allows unauthenticated attackers to modify the status of arbitrary orders, such as marking unpaid orders as paid and reducing stock levels. **Recommendations** Update the plugin to version 2.8.9 or later. Ensure the secret key is properly configured immediately after activation to enable callback verification.

**Name of the Vulnerable Software and Affected Versions** WP Edit Password Protected WordPress plugin versions prior to 2.0.7 **Description** The plugin fails to enforce site-wide access restrictions on the WordPress REST API. This allows unauthenticated users to read the content of published posts and pages that were intended to be hidden by the site's access mode configuration. **Recommendations** Update the plugin to version 2.0.7 or later.

**Name of the Vulnerable Software and Affected Versions** WP Fusion Lite versions prior to 3.48.0 **Description** Two admin AJAX handlers fail to perform a capability check, which allows any authenticated subscriber to read the email addresses of other users and trigger a cross-user CRM re-sync. **Recommendations** Update WP Fusion Lite to version 3.48.0 or later.

**Name of the Vulnerable Software and Affected Versions** Paytm Payment Gateway WordPress plugin versions prior to 2.8.9 **Description** Insufficient sanitization and escaping of data stored from payment callbacks allows unauthenticated users to store malicious scripts. These scripts execute within the session of a store administrator when viewed on an admin page. This issue occurs when the gateway is enabled without credentials, as the integrity check on the callbacks can be forged. **Recommendations** Update the plugin to version 2.8.9 or later.

**Name of the Vulnerable Software and Affected Versions** The Image Optimizer WordPress plugin versions prior to 1.7.7 **Description** The plugin fails to enforce intended capability checks on several read REST routes. This allows any authenticated user to access attachment metadata and site-wide statistics, information that should be restricted to users with administrator privileges. **Recommendations** Update the plugin to version 1.7.7 or later.

**Name of the Vulnerable Software and Affected Versions** Paymattic WordPress plugin versions 4.6.20 through 4.6.25 **Description** The plugin fails to verify if a confirmed Stripe payment is associated with the specific order it is being applied to. This allows unauthenticated users to mark any pending order as paid by confirming a smaller payment of their own against that order. **Recommendations** Update Paymattic WordPress plugin to version 4.6.26.

**Name of the Vulnerable Software and Affected Versions** Bookly WordPress plugin versions prior to 28.3 **Description** An issue exists where the software fails to properly verify a customer's identity before updating stored details. This allows unauthenticated attackers who possess a customer's primary identifier to overwrite personal information, including name, email, and address. **Recommendations** Update Bookly WordPress plugin to version 28.3 or later.

**Name of the Vulnerable Software and Affected Versions** WPC Smart Compare for WooCommerce WordPress plugin versions prior to 6.6.1 **Description** The plugin fails to apply WordPress post-password protection when returning product content via its comparison handler. This allows unauthenticated users to access and read the descriptions of products that are password-protected. **Recommendations** Update the plugin to version 6.6.1 or later.

**Name of the Vulnerable Software and Affected Versions** YAHMAN Add-ons WordPress plugin versions prior to 0.9.31 **Description** The plugin fails to validate the type of remote files it caches within a publicly accessible directory. This allows unauthenticated attackers to write arbitrary PHP files to the server, potentially leading to Remote Code Execution (RCE), which is the ability to execute arbitrary commands on a remote machine, when the relevant feature is enabled. **Recommendations** Update YAHMAN Add-ons WordPress plugin to version 0.9.31 or later.

🚨 CVE-2026-84098 The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary listings, including ones belonging to other users. This is an incomplete fix of CVE-2023-1889 / CVE-2023-35052: a separate, unaddressed listing-deletion path allows the same impact, from at least version 3.1.0 through the current release. 🎖@cveNotify

**Name of the Vulnerable Software and Affected Versions** Real3D Flipbook versions prior to 5.4 **Description** Insufficient capability checks on authenticated flipbook management actions allow users with Author-level access and above to delete flipbook content belonging to other users and overwrite global settings reserved for administrators. This flaw can be exploited to perform a stored Cross-Site Scripting (XSS) attack, where malicious JavaScript is executed in the context of any visitor or administrator viewing the site. **Recommendations** Update the plugin to version 5.4 or later.