CVE-2026-121509 Headless CMS Plugin REST API post get_required_post_data information disclosure

A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function getrequiredpostdata of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument postid/postslug results in information disclosure. The attack may be...

CVE-2026-120578 AI Alt Text Generator <= 2.7.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Modification via 'post_id' Parameter

The AI Alt Text Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.7.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the alt...

CVE-2026-120578

The AI Alt Text Generator plugin for WordPress (versions up to and including 2.7.0 ) is vulnerable to an authorization bypass due to insufficient verification of user permissions. This flaw allows unauthenticated attackers to modify the alt text , and potentially the title , caption , and descrip...

CVE-2026-121509: n/a Headless CMS Plugin: A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress

A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function getrequiredpostdata of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument postid/postslug results in information disclosure. The attack may be...

CVE-2026-119059

The Content Egg plugin for WordPress (versions up to and including 12.0.0 ) is vulnerable to unauthorized data modification. The ajaxUpdateProducts() function fails to perform a per-object capability check (e.g., current_user_can('edit_post', $post_id)) on the post_id parameter, despite verifying...

CVE-2026-119059 Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Meta Modification via 'post_id' Parameter via cegg_update_products AJAX Action

The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts function in versions up to, and including, 12.0.0. The handler verifies a static nonce 'contenteggmetabox' and the generic 'editposts'...

CVE-2026-119059 Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Meta Modification via 'post_id' Parameter via cegg_update_products AJAX Action

The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts function in versions up to, and including, 12.0.0. The handler verifies a static nonce 'contenteggmetabox' and the generic 'editposts'...

CVE-2026-92086

The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.7 via the 'postid' parameter. This makes it possible for unauthenticated attackers to extract personally identifiable information from other users' form inquiry records,...

CVE-2026-92086 MW WP Form <= 5.1.7 - Unauthenticated Sensitive Information Exposure in 'post_id' Parameter

The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.7 via the 'postid' parameter. This makes it possible for unauthenticated attackers to extract personally identifiable information from other users' form inquiry records,...

CVE-2026-92086

The MW WP Form plugin for WordPress (versions up to and including 5.1.7 ) is vulnerable to Sensitive Information Exposure via the post_id parameter. This flaw allows unauthenticated attackers to extract personally identifiable information (PII)—such as names, email addresses, and free-text messag...

CVE-2026-92086 MW WP Form <= 5.1.7 - Unauthenticated Sensitive Information Exposure in 'post_id' Parameter

The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.7 via the 'postid' parameter. This makes it possible for unauthenticated attackers to extract personally identifiable information from other users' form inquiry records,...

CVE-2026-92086 MW WP Form <= 5.1.7 - Unauthenticated Sensitive Information Exposure in 'post_id' Parameter

The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.7 via the 'postid' parameter. This makes it possible for unauthenticated attackers to extract personally identifiable information from other users' form inquiry records,...

EUVD-2026-112747

The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.7 via the 'postid' parameter. This makes it possible for unauthenticated attackers to extract personally identifiable information from other users' form inquiry records,...

CVE-2026-92086: websoudan MW WP Form: The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and…

The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.7 via the 'postid' parameter. This makes it possible for unauthenticated attackers to extract personally identifiable information from other users' form inquiry records,...

WordPress MW WP Form information disclosure vulnerability

WordPress MW WP Form versions 5.1.7 and earlier contain an information disclosure vulnerability. This vulnerability arises from the postid parameter, which allows sensitive information to be exposed. Unauthenticated attackers can enumerate consecutive post IDs to extract personal identifying...

WordPress MW WP Form plugin <= 5.1.7 - Unauthenticated Sensitive Information Exposure in 'post_id' Parameter vulnerability

Unauthenticated Sensitive Information Exposure in 'postid' Parameter vulnerability discovered by RIA Labs in WordPress Plugin MW WP Form versions = 5.1.7...

WordPress AI Alt Text Generator plugin <= 2.7.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Modification via 'post_id' Parameter vulnerability

Missing Authorization to Unauthenticated Arbitrary Attachment Modification via 'postid' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin AI Alt Text Generator versions = 2.7.0...

CVE-2026-96567

The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postid' parameter in all versions up to, and including, 5.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

CVE-2026-96567 MW WP Form <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'post_id' Parameter (via stored form-submitted post meta)

The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postid' parameter in all versions up to, and including, 5.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

EUVD-2026-91239

The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postid' parameter in all versions up to, and including, 5.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...