rahulbhangale WP Promoter

• CVE-2026-8906 Medium 6.1 WP Promoter <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'popup_width' Parameter 0.1%
• CVE-2026-9014 Medium 5.3 WP Promoter <= 1.3 - Missing Authorization to Unauthenticated Statistics Reset via wpp-reset_stats AJAX Action 0.3%