CVE-2026-77127 Information Disclosure in extension "Modules" (modules)

The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privileged backend user can supply arbitrary table, field and record parameters, and trigger an error response that discloses the current databa...

EUVD-2026-65348

The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privileged backend user can supply arbitrary table, field and record parameters, and trigger an error response that discloses the current databa...

CVE-2026-77127 Information Disclosure in extension "Modules" (modules)

The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privileged backend user can supply arbitrary table, field and record parameters, and trigger an error response that discloses the current databa...

CVE-2026-77127

CVE-2026-77127 affects the TYPO3 extension "Modules" (modules) . The extension's backend AJAX endpoint for inline editing fails to restrict access to fields the current user is permitted to see or edit. An authenticated, low-privileged TYPO3 backend user can supply arbitrary table, field, and rec...

CVE-2026-16601 CM Map Locations <= 2.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via cmloc_route_image_upload AJAX Action

The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type validation in the upload handler, which...

CVE-2026-17089 Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'headerformat' parameter in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-75982

The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpresscreatepage AJAX action. The LPAdminAjax::createpage handler only checks the editpages capability and a wprest nonce both availabl...

CVE-2026-75982 LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter

The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpresscreatepage AJAX action. The LPAdminAjax::createpage handler only checks the editpages capability and a wprest nonce both availabl...

EUVD-2026-65272

The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpresscreatepage AJAX action. The LPAdminAjax::createpage handler only checks the editpages capability and a wprest nonce both availabl...

CVE-2026-75982 LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter

The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpresscreatepage AJAX action. The LPAdminAjax::createpage handler only checks the editpages capability and a wprest nonce both availabl...

CVE-2026-19801

The BetterLinks WordPress plugin (Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP) is vulnerable to authorization bypass in all versions up to and including 3.1.0 . The root cause is improper verification of user authorization in the create_fbs_link AJAX action, allowing an...

PT-2026-81497

Name of the Vulnerable Software and Affected Versions TranslatePress versions prior to 3.3.2 Description An unauthenticated attacker can retrieve a plaintext password-reset URL via the trp get translations regular AJAX endpoint, enabling the takeover of any administrator account. This issue affec...

VulnCheck KEV: CVE-2026-19632

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trpgettranslationsregular' AJAX action. This makes it possible for unauthenticated attackers to extract t...

CVE-2026-14853

The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...

EUVD-2026-64636

The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...

CVE-2026-16612

The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two...

CVE-2026-16612

CVE-2026-16612 affects the FiboSearch WordPress plugin prior to version 1.34.1 . The plugin fails to consistently exclude password-protected products from two unauthenticated AJAX endpoints : the autocomplete search endpoint (dgwt_wcas_ajax_search) and the Details Panel endpoint (dgwt_wcas_result...

CVE-2026-16612 FiboSearch < 1.34.1 - Unauthenticated Password-Protected Product Information Disclosure

The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two...

EUVD-2026-64217

The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two...

CVE-2026-76074 AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_campaign_monitor_get_lists AJAX Action

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an...