CVE-2026-86786

The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the title, excerpt and permalink of non-public posts, including drafts, pending, scheduled, private and trashed posts, as wel...

CVE-2022-1329

CVE-2022-1329 El plugin Elementor Website Builder para WordPress es vulnerable a la ejecución no autorizada de varias acciones AJAX debido a una verificación de capacidades faltante en el archivo /core/app/modules/onboarding/module.php, lo que hace posible que los atacantes modifiquen datos del...

CVE-2021-38314

Exploit en Python para CVE-2021-38314 Detalle El plugin Gutenberg Template Library & Redux Framework Ejemplo PoC - https://youtu.be/n1e4aFmXvOk Enlaces CVE-2021-38314...

WCFM Membership <= 2.10.0 - Broken Access Control

The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks true the AJAX actions: wcfm-memberships, wcfm-memberships-manage, and wcfm-memberships-settings. id: CVE-2022-4940 info:...

Ubigeo de Peru < 3.6.4 - SQL Injection

The plugin does not properly sanitise and escape some parameters before using them in SQL statements via various AJAX actions, some of which are available to unauthenticated users, leading to SQL Injections. id: CVE-2022-0814 info: name: Ubigeo de Peru 3.6.4 - SQL Injection author: r3Y3r53...

CVE-2020-12077

CVE-2020-12077 MapPress Maps Pro 2.53.9 - Ejecución Remota de Código RCE debido a un Control de Acceso Incorrecto en Acciones AJAX Descripción La versión profesional de este plugin registra varias acciones AJAX que llaman a funciones que carecen de comprobaciones de capacidad y comprobaciones de...

CVE-2021-38314

Divulgación de Información Sensible No Autenticada CVE-2021-38314 Exploit en Python para CVE-2021-38314 Use: python3 cve-2021-38314.py http://www.target.com El plugin Gutenberg Template Library & Redux Framework = 4.2.11 para WordPress registró varias acciones AJAX disponibles para usuarios no...

CVE-2021-38314

CVE-2021-38314 ¿Cuál es la vulnerabilidad? El plugin Gutenberg Template Library & Redux Framework = 4.2.11 para WordPress registró varias acciones AJAX disponibles para usuarios no autenticados en la función includes en redux-core/class-redux-core.php que eran únicas para un sitio dado pero...

CVE-2026-97227

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonce alone, allowing users an administrator has granted access to its posting features to export the site's configured social...

CVE-2026-86839

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify a...

CVE-2026-97227 NextScripts: Social Networks Auto-Poster < 4.4.8 - Authenticated Social Account Credential Disclosure and Data Deletion

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonce alone, allowing users an administrator has granted access to its posting features to export the site's configured social...

CVE-2026-97227 NextScripts: Social Networks Auto-Poster < 4.4.8 - Authenticated Social Account Credential Disclosure and Data Deletion

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonce alone, allowing users an administrator has granted access to its posting features to export the site's configured social...

CVE-2026-97227

The NextScripts: Social Networks Auto-Poster WordPress plugin (versions before 4.4.8 ) is vulnerable to an authentication bypass. The plugin fails to perform proper capability or ownership checks on several AJAX actions, relying solely on a nonce . This allows users granted access to posting feat...

CVE-2026-86839

The Online Scheduling and Appointment Booking System (Bookly) WordPress plugin, in versions before 28.3 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The root cause is a failure to verify that appointment and payment records requested through staff-role AJAX actions actually bel...

CVE-2026-86839 Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDOR

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify a...

EUVD-2026-87890

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify a...

CVE-2026-86839 Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDOR

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify a...

CVE-2026-97227: Missing Authorization

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonce alone, allowing users an administrator has granted access to its posting features to export the site's configured social...

CVE-2026-86839: Authorization Bypass Through User-Controlled Key

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify a...

CVE-2026-93399

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'booklygetformid', 'booklyrendercomplete', 'booklyaddtocalendar' and 'booklyrollbackorder' AJAX actions. This is due to the 'booklygetformid' handler blindly storing th...