CVE-2026-11588

The EONSR AEO Agent WordPress plugin through 3.7.9 does not perform any authorisation check on one of its REST API routes and disables HTML sanitisation before saving the post, allowing unauthenticated attackers to create administrator-attributed published posts containing arbitrary web scripts...

EUVD-2026-53736

The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes, allowing unauthenticated users to read published entries of custom post types that the site registered as...

CVE-2026-13154 Essential Blocks < 6.4.0 - Unauthenticated Non-Public Custom Post Type Content Disclosure via queries Endpoint

The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes, allowing unauthenticated users to read published entries of custom post types that the site registered as...

CVE-2026-13154 Essential Blocks < 6.4.0 - Unauthenticated Non-Public Custom Post Type Content Disclosure via queries Endpoint

The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes, allowing unauthenticated users to read published entries of custom post types that the site registered as...

CVE-2026-13153

The Gutenberg Essential Blocks WordPress plugin (versions before 6.4.0 ) is vulnerable to an information disclosure flaw. The issue stems from unrestricted access to a public REST route that over-fetches non-public WooCommerce per-product sales metrics. This allows unauthenticated users to read t...

CVE-2026-11588

The EONSR AEO Agent WordPress plugin through 3.7.9 does not perform any authorisation check on one of its REST API routes and disables HTML sanitisation before saving the post, allowing unauthenticated attackers to create administrator-attributed published posts containing arbitrary web scripts...

EUVD-2026-53728

The EONSR AEO Agent WordPress plugin through 3.7.9 does not perform any authorisation check on one of its REST API routes and disables HTML sanitisation before saving the post, allowing unauthenticated attackers to create administrator-attributed published posts containing arbitrary web scripts...

CVE-2026-18050

The Events Manager WordPress plugin (versions before 7.4 ) contains an authorization flaw in a REST route that serves temporarily stored file uploads. This allows unauthenticated users to retrieve another user's in-progress upload if the temporary identifier is known. Because the identifier is hi...

CVE-2026-18050 Events Manager < 7.4 - Unauthenticated Pending Upload Disclosure via events-manager/v1/uploads

The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy,...

CVE-2026-18050

The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy,...

cvelistV5 cve_2026-08-06_0000Z

Note 2026-2-17 Adding Additional day of processing for date normalization to addreess potential inconsistencies New Date Normalization schedule: 2/16/26 - 2/28/26 Note 2026-2-10 Record Date NormalizationdeltaLog.json file change The deltaLog.json file normally retains a rolling 30 days worth of C...

CVE-2025-15674: Incorrect Authorization

The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the editposts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of...

PT-2026-68631

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a privileged user in one tenant to perform operation...

CVE-2026-3418: Unrestricted Upload of File with Dangerous Type

The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful...

PT-2026-68634

Name of the Vulnerable Software and Affected Versions CoCart WordPress plugin versions prior to 4.9.0 Description An issue exists where the software fails to validate user-supplied price values against the actual product price when items are added to the cart via public REST API endpoints. This...

PT-2026-68448

Name of the Vulnerable Software and Affected Versions WSO2 products affected versions not specified Description Tokens issued to low-privileged users lack sufficient restrictions, enabling them to be used to access product-level Admin REST APIs. An attacker with a low-privileged account and a val...

PT-2026-68403

Name of the Vulnerable Software and Affected Versions Events Manager versions prior to 7.4 Description An authorization check is missing on a REST route that serves temporarily stored file uploads. This allows unauthenticated users to retrieve another user's in-progress upload if the temporary...

PT-2026-68388

Name of the Vulnerable Software and Affected Versions Gutenberg Essential Blocks versions prior to 6.4.0 Description The plugin fails to verify if a post type provided by a user is publicly viewable before querying it through a public REST route. This allows unauthenticated users to read publishe...

CVE-2026-13399: Authorization Bypass Through User-Controlled Key

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass payments...

CVE-2025-14561: Improper Access Control

In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publishe...