EUVD-2026-63827

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handleemailotpreturn function returning the secret magic login token in the response t...

CVE-2026-77264 Automation Web Platform <= 4.8.6 - Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosure

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handleemailotpreturn function returning the secret magic login token in the response t...

CVE-2026-77264 Automation Web Platform <= 4.8.6 - Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosure

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handleemailotpreturn function returning the secret magic login token in the response t...

WordPress WCFM Marketplace plugin < 3.8.1 - Store Vendor+ Cross-Vendor Review Deletion and Status Update via IDOR vulnerability

Store Vendor+ Cross-Vendor Review Deletion and Status Update via IDOR vulnerability discovered by Mustafa Ahmed in WordPress Plugin WCFM Marketplace versions 3.8.1...

WordPress TenWeb Speed Optimizer plugin < 2.33.5 - Unauthenticated Stored XSS via Critical CSS Token Bypass vulnerability

Unauthenticated Stored XSS via Critical CSS Token Bypass vulnerability discovered by Jakub Herman in WordPress Plugin 10Web Booster – Website speed optimization, Cache & Page Speed optimizer versions 2.33.5...

WordPress Dinatur plugin <= 1.18 - Unauthenticated SQL Injection via Column Name Injection vulnerability

Unauthenticated SQL Injection via Column Name Injection vulnerability discovered by João Ramos Maciel and Theo Antonio da Fonseca in WordPress Plugin Dinatur versions = 1.18...

WordPress Eventin plugin < 4.1.21 - Contributor+ Schedule Deletion and Modification via IDOR vulnerability

Contributor+ Schedule Deletion and Modification via IDOR vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Event SOlution versions 4.1.21...

WordPress Eventin plugin < 4.1.21 - Contributor+ User Role and Meta Modification via Speaker Creation vulnerability

Contributor+ User Role and Meta Modification via Speaker Creation vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WP Event SOlution versions 4.1.21...

WordPress Eventin plugin < 4.1.21 - Contributor+ Speaker Account Deletion via IDOR vulnerability

Contributor+ Speaker Account Deletion via IDOR vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Event SOlution versions 4.1.21...

CVE-2026-18781

creationtimestamp| type| source ---|---|--- 2026-08-21 07:30:26+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mtlai4n7vj2t...

WordPress Eventin plugin < 4.1.21 - Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeover via IDOR vulnerability

Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeover via IDOR vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WP Event SOlution versions 4.1.21...

WordPress Gift Cards For WooCommerce Pro plugin < 4.2.10 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Brandon Steed in WordPress Plugin Gift Cards For WooCommerce Pro versions 4.2.10...

CVE-2026-73537

Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser component WebView running on the affected product, resulting in the displayed content being altered...

EUVD-2026-63826

Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser component WebView running on the affected product, resulting in the displayed content being altered...

CVE-2026-73537

Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser component WebView running on the affected product, resulting in the displayed content being altered...

CVE-2026-16323 Authentication Bypass via Execution After Redirect in FuyaSoft's Architect Panel Web Management Panel

Execution after redirect EAR vulnerability in FuyaWeb Internet and Informatics Services ArchitectPanel Web Admin Panel allows Authentication Bypass. This issue affects ArchitectPanel Web Admin Panel: through 28072026...

EUVD-2026-63825

Execution after redirect EAR vulnerability in FuyaWeb Internet and Informatics Services ArchitectPanel Web Admin Panel allows Authentication Bypass. This issue affects ArchitectPanel Web Admin Panel: through 28072026...

CVE-2026-16323 Authentication Bypass via Execution After Redirect in FuyaSoft's Architect Panel Web Management Panel

Execution after redirect EAR vulnerability in FuyaWeb Internet and Informatics Services ArchitectPanel Web Admin Panel allows Authentication Bypass. This issue affects ArchitectPanel Web Admin Panel: through 28072026...

CVE-2026-19435

The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content...

CVE-2026-75796

The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network,...