EUVD-2026-83512

The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, from a configured site...

CVE-2026-92404

The MgoSync WordPress plugin versions 2.1.5 through 2.1.6 is vulnerable to an unauthenticated WooCommerce API Credential Disclosure vulnerability. Due to a lack of authorization controls on a specific REST API endpoint , an unauthenticated user can retrieve stored WooCommerce API credentials, inc...

CVE-2026-92404 MgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential Disclosure

The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, from a configured site...

CVE-2026-92404 MgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential Disclosure

The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, from a configured site...

CVE-2026-88824 Master Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label Settings

The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that executes in the session of any administrator...

EUVD-2026-83507

The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that executes in the session of any administrator...

CVE-2026-86591 Botiga Pro < 1.6.5 - Unauthenticated Arbitrary Blog Options Update via Templates Builder REST Route

The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full site takeover. The same route also allo...

EUVD-2026-83505

The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full site takeover. The same route also allo...

CLEANSTART-2026-GB37349 flaw was found in the admin REST API of Keycloak, a solution for identity and access management

Security vulnerability affects the keycloak package. A flaw was found in the admin REST API of Keycloak, a solution for identity and access management...

CVE-2026-94000: Missing Authorization

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated...

CVE-2026-94001: Missing Authorization

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from...

PT-2026-95827

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Admin REST API of Keycloak. The endpoint used for deleting user credentials fails to correctly verify fine-grained reset-password permissions. This allows a delegated...

CVE-2026-9289: Exposure of Sensitive Information to an Unauthorized Actor

The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes jsonld/id, jsonld/http/itemid,...

PT-2026-95775

Name of the Vulnerable Software and Affected Versions Create plugin for WordPress versions prior to 2.5.4 Description An issue exists where authenticated attackers with author-level access or higher can perform a SQL Injection. This occurs because the order by parameter is not sufficiently escape...

PT-2026-95758

Name of the Vulnerable Software and Affected Versions Botiga Pro versions prior to 1.6.5 Description Lack of authorization checks on a REST route allows unauthenticated users to update arbitrary WordPress options with arbitrary values. This can lead to privilege escalation and full site takeover...

PT-2026-95760

Name of the Vulnerable Software and Affected Versions Master Blocks versions prior to 1.5.0 Description An authorization flaw exists in a REST route that allows unauthenticated users to update plugin settings. This includes the ability to modify a value that is output unescaped in the...

PT-2026-95826

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Admin REST API of Keycloak. The issue resides in the group-membership endpoints, where the system does not verify if a group grants administrative privileges before...

PT-2026-95770

Name of the Vulnerable Software and Affected Versions Mailchimp for WooCommerce WordPress plugin versions prior to 6.1.1 Description Several REST API routes fail to verify if the requesting user possesses the necessary capabilities within the permission callback. This allows unauthenticated users...

CVE-2026-88824: Improper Neutralization of Input During Web Page Generation

The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that executes in the session of any administrator...

CVE-2026-92435: Missing Authorization

The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state...