WordPress Login & Register Forms plugin < 4.0.2 - Unauthenticated Account Takeover via Password Reset Verification State Keyed on a Client-Supplied Address Header vulnerability

Unauthenticated Account Takeover via Password Reset Verification State Keyed on a Client-Supplied Address Header vulnerability discovered by Artus KG in WordPress Plugin Login/Signup Popup versions 4.0.2...

CVE-2026-56592 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an unauthenticated attacker to execute sustained brute-force attacks against the login interface, resulting in unauthorized system access...

CVE-2026-56592

HCL BigFix Service Management is affected by an Improper Authentication vulnerability caused by inadequate account lockout mechanisms. An unauthenticated attacker can execute sustained brute-force attacks against the login interface, potentially achieving unauthorized system access . The CVSS v3....

CVE-2026-56592 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an unauthenticated attacker to execute sustained brute-force attacks against the login interface, resulting in unauthorized system access...

CVE-2026-67103

HCL BigFix Service Management is affected by Cross-Site Scripting XSS vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute in a victim's browser, enabling session hijacking, account takeover, and unauthorized actions on behalf of affected users...

WordPress Login & Register Forms plugin < 4.0.2 - Unauthenticated Account Takeover via Password Reset Code Brute Force vulnerability

Unauthenticated Account Takeover via Password Reset Code Brute Force vulnerability discovered by ryan fabella in WordPress Plugin Login/Signup Popup versions 4.0.2...

WordPress InfiniteWP Client plugin < 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite vulnerability

Unauthenticated Administrator Account Takeover on Multisite vulnerability discovered by Jakub Herman in WordPress Plugin InfiniteWP Client versions 1.13.6...

CVE-2026-67103 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by Cross-Site Scripting XSS vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute in a victim's browser, enabling session hijacking, account takeover, and unauthorized actions on behalf of affected users...

CVE-2026-67103 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by Cross-Site Scripting XSS vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute in a victim's browser, enabling session hijacking, account takeover, and unauthorized actions on behalf of affected users...

CVE-2026-67103

HCL BigFix Service Management is affected by a Cross-Site Scripting (XSS) vulnerability that allows an attacker to inject unsanitized malicious scripts executed in a victim's browser. The stated impact includes session hijacking , account takeover , and unauthorized actions on behalf of affected ...

EUVD-2026-82769

HCL BigFix Service Management is affected by Cross-Site Scripting XSS vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute in a victim's browser, enabling session hijacking, account takeover, and unauthorized actions on behalf of affected users...

WordPress SoftMarket plugin <= 1.0.0 - Unauthenticated Account Takeover via Email Verification Bypass vulnerability

Unauthenticated Account Takeover via Email Verification Bypass vulnerability discovered by Pedro Pinho in WordPress Plugin SoftMarket — Digital Marketplace versions = 1.0.0...

CVE-2026-90977

The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it...

CVE-2026-90976

The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler, allowing unauthenticated users to create accounts even when the site has registration disabled...

Exploit for CVE-2026-93453

CVE-2026-93453 — SOGo Password Reset Link Poisoning via Origin...

CVE-2026-85123

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to create WordPress accounts on a site whose owner has disabled registration...

EUVD-2026-82689

The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it...

CVE-2026-90977

The Clean Login WordPress plugin prior to version 1.19 fails to verify the registration CAPTCHA when the stored session value is empty. This allows unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving the CAPTCHA. The vulnerabili...

WordPress Clean Login plugin < 1.19 - Unauthenticated Account Creation with Registration Disabled vulnerability

Unauthenticated Account Creation with Registration Disabled vulnerability discovered by Artus KG in WordPress Plugin Clean Login versions 1.19...

CVE-2026-90976 Clean Login < 1.19 - Unauthenticated Account Creation with Registration Disabled

The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler, allowing unauthenticated users to create accounts even when the site has registration disabled...