EUVD-2026-64211

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an...

CVE-2026-75027 Themify Builder <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Action

The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the stored...

EUVD-2026-64210

The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the stored...

EUVD-2026-64209

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an...

PT-2026-79514

Name of the Vulnerable Software and Affected Versions Slider Hero with Video Background, Animation WordPress plugin versions prior to 9.1.3 Description Lack of authorization and nonce checks on two request handlers, combined with a failure to escape a stored setting before output, allows...

CVE-2026-15046

The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, allowing attackers to take over the connector token by tricking a logged-in administrator into clicking a crafted link CSRF...

EUVD-2026-63908

The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, allowing attackers to take over the connector token by tricking a logged-in administrator into clicking a crafted link CSRF...

CVE-2026-15046

LitExtension: Store to WooCommerce Migration WordPress plugin (through 1.2.5 ) is vulnerable to a CSRF attack that allows an attacker to overwrite the store-migration connector's authentication token. The root cause is a missing nonce verification before an administrative action that modifies the...

CVE-2026-15046 LitExtension: Store to WooCommerce Migration <= 1.2.5 - Connector Token Takeover via CSRF

The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, allowing attackers to take over the connector token by tricking a logged-in administrator into clicking a crafted link CSRF...

CVE-2026-15046 LitExtension: Store to WooCommerce Migration <= 1.2.5 - Connector Token Takeover via CSRF

The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, allowing attackers to take over the connector token by tricking a logged-in administrator into clicking a crafted link CSRF...

CVE-2026-16962

The Tamara Checkout WordPress plugin, in versions through 1.9.9.20 , is vulnerable to an unauthenticated order status manipulation vulnerability. The root cause is a failure to verify the order key , nonce , or user capability on public payment cancel/fail return URLs. An unauthenticated attacker...

CVE-2026-16962 Tamara Checkout <= 1.9.9.20 - Unauthenticated Order Status Manipulation

The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any capability on its public payment cancel/fail return URLs, changing a WooCommerce order's status based solely on an attacker-supplied numeric order id, so an unauthenticated attacker can cancel or...

PT-2026-79503

Name of the Vulnerable Software and Affected Versions Themify Builder versions prior to 7.8.1 Description The plugin fails to properly verify user authorization when performing certain actions. This allows unauthenticated attackers to modify stored styling data, specifically padding and margin...

PT-2026-79504

Name of the Vulnerable Software and Affected Versions AutomatorWP versions prior to 5.8.5 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated users with subscriber-level access or higher can...

PT-2026-79505

Name of the Vulnerable Software and Affected Versions AutomatorWP versions prior to 5.8.5 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated users with subscriber-level access or higher can...

PT-2026-79367

Name of the Vulnerable Software and Affected Versions LitExtension WordPress plugin versions prior to 1.2.6 Description The plugin fails to verify a nonce a unique token used to prevent replay attacks before performing an administrative action that overwrites the store-migration connector's...

GHSA-6WVW-VRW4-363W node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS

Summary A process-global nonce cache with no eviction policy allows an unauthenticated remote attacker to exhaust server heap memory by repeatedly opening sessions, causing the node-opcua server process to crash. Affected versions: = 2.165.0 Tested version: 2.165.0 CVSS Score: 7.5 High CVSS Vecto...

node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS

Summary A process-global nonce cache with no eviction policy allows an unauthenticated remote attacker to exhaust server heap memory by repeatedly opening sessions, causing the node-opcua server process to crash. Affected versions: = 2.165.0 Tested version: 2.165.0 CVSS Score: 7.5 High CVSS Vecto...

NPM: node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS

NPM: node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS vulnerability discovered by ? in WordPress Npm node-opcua versions 2.166.0...

GHSA-MQ36-523M-X7VV node-opcua missing nonce verification in UserNameIdentityToken authentication

Summary A missing nonce verification in the UserNameIdentityToken authentication handler allows an unauthenticated remote attacker to forge a password token that extracts as an empty string, and to replay captured authentication tokens across sessions. Affected versions: = 2.165.0 Tested version:...