The WordPress plugin Login with phone number up to and including version 1.8.78 contains a broken authentication flaw (CWE-1390, CVSS 8.8 per the CNA). According to Patchstack, an attacker can bypass the login system or log in as other users without their password. Patchstack lists the required privilege as Subscriber, so a low-privilege account may be needed, but the exact precondition is not confirmed.
Hamid Alinia · Login with phone number
The WordPress plugin BuddyPress contains a blind SQL injection vulnerability (CWE-89) in versions up to and including 14.5.2. An authenticated attacker with a low-privilege account can inject SQL commands and extract database content, including user accounts and private data, although this is slow and requires many requests. Patchstack rates the issue as high priority with a CVSS score of 8.5, while VulDB gives 6.3; the NVD analysis is still pending.
WordPress BuddyPress · BuddyPress
The Motors - Car Dealership & Classified Listings WordPress plugin up to and including 1.4.126 contains a blind SQL injection vulnerability (CWE-89). An unauthenticated remote attacker can send crafted requests to read, modify or delete database contents, including user accounts and private data. Patchstack rates the issue as high priority with a CVSS score of 9.3.
StylemixThemes · Motors
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
LearnPress, a WordPress plugin for creating and selling online courses, contains a missing authorization flaw (CWE-862) in versions up to and including 4.4.11. An unauthenticated remote attacker may be able to access functions or data they should not see, such as other users' information. The CVSS base score is 7.5 with a high impact on confidentiality only; the vulnerable endpoint is not described in the sources, and VulDB rates the issue lower (5.3).
ThimPress · LearnPress
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
The WordPress plugin GEO my WordPress (geo-my-wp) in versions up to and including 4.5.5.5 lacks proper authorization checks. According to the CNA, an unauthenticated remote attacker may be able to access functions or data they should not reach, with a high confidentiality impact. Exposure depends on a publicly reachable WordPress site running the affected plugin.
Eyal Fitoussi · GEO my WordPress
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
The Foxit official website embeds a third-party API token in its JavaScript code, so any visitor can read it. An attacker who obtains the token can submit fake user behavior data and distort Foxit's data statistics. The Foxit bulletin states the token is used to submit user behavior data; the CNA record rates the impact as information disclosure with high confidentiality impact.
Foxit Software Inc. · foxit.com
The online HTML-to-PDF conversion service on Foxit's official website contains a server-side request forgery (SSRF) flaw. By submitting ZIP-formatted input, an unauthenticated remote attacker can bypass restrictions on requests to internal IP addresses and may discover internal network resources. The vulnerability affects Foxit's hosted service, not customer installations, and Foxit states that the fix was released on 29 October 2026.
Foxit Software Inc. · foxit.com HTML-to-PDF conversion service
A broken access control flaw in the online HTML-to-PDF conversion service on Foxit's official website uses a shared token for submitted documents. An unauthenticated remote attacker may be able to access conversion documents submitted by other users. Foxit's bulletin says the issue is fixed on the server side and no customer action is required.
Foxit Software Inc. · foxit.com HTML-to-PDF online service
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
