EUVD-2026-111972

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registered through its email one-time-password flow, which could allow unauthenticated users to register and log in without being approved by an administrator when bo...

WordPress WholesaleX plugin < 3.0.9 - Unauthenticated Account Activation and Administrator Approval Bypass vulnerability

Unauthenticated Account Activation and Administrator Approval Bypass vulnerability discovered by Naoki Kawahigashi in WordPress Plugin WholesaleX versions 3.0.9...

CVE-2026-111955

The WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before comparing it with the one supplied in a request, allowing unauthenticated users to activate pending accounts and bypass the administrator approval required before login...

CVE-2026-111955 WholesaleX < 3.0.9 - Unauthenticated Account Activation and Administrator Approval Bypass

The WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before comparing it with the one supplied in a request, allowing unauthenticated users to activate pending accounts and bypass the administrator approval required before login...

CVE-2026-111955

The WholesaleX WordPress plugin (versions before 3.0.9 ) is vulnerable to an Improper Authentication flaw (CWE-287 ). The software fails to verify if a stored account confirmation code exists before comparing it against a code provided in an incoming request. This oversight allows unauthenticated...

CVE-2026-111955 WholesaleX < 3.0.9 - Unauthenticated Account Activation and Administrator Approval Bypass

The WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before comparing it with the one supplied in a request, allowing unauthenticated users to activate pending accounts and bypass the administrator approval required before login...

EUVD-2026-107077

The WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before comparing it with the one supplied in a request, allowing unauthenticated users to activate pending accounts and bypass the administrator approval required before login...

PT-2026-120472

The WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before comparing it with the one supplied in a request, allowing unauthenticated users to activate pending accounts and bypass the administrator approval required before login...

CVE-2026-76242

stigmem-node 0.9.0a1 accepted federation peer key material during peer registration without a separate administrator out-of-band fingerprint approval step. On nodes that accept federation peer registration over a network where initial registration can be intercepted or misdirected, an attacker ca...

CVE-2026-19711

The Premium Packages – Sell Digital Products Securely WordPress plugin (versions before 7.0.7 ) contains a vulnerability where it fails to validate withdrawal requests against a user's actual earned balance. This flaw allows any authenticated user , including a subscriber with no sales history, t...

CVE-2026-13164 Unauthenticated self-registration in MailerUp allows access to stored email data

Missing Authentication for Critical Function CWE-306 in the RegisterView apps/accounts/views.py, exposed at POST /api/auth/register/, in MailerUp 1.0.1 allows a remote, unauthenticated attacker to self-register a working account on instances where registration is intended to be restricted, becaus...

EUVD-2026-35292

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the comment text in all versions up to, and including, 7.5.49.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

stigmem-node's federation peer registration lacked explicit out-of-band approval

Impact Federation peer registration accepted peer key material during registration without a separate administrator approval step based on an out-of-band fingerprint check. Impacted deployments are nodes that accept federation peer registration across a network where initial registration could be...

Insufficient Verification of Data Authenticity

Overview stigmem-node is a Stigmem reference node — single-host production implementation Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the peer registration process. An attacker can impersonate a federation peer or intercept registration by...

Devolutions Server security vulnerabilities

Devolutions Server is an application system developed by the Canadian company Devolutions. It provides a fully functional solution for shared accounts and password management. Versions of Devolutions Server from 2026.1.6.0 to 2026.1.16.0, as well as versions prior to 2025.3.20.0, have security...

EUVD-2025-23282

Malicious code in bioql PyPI...

EUVD-2022-3477

Malicious code in bioql PyPI...

CVE-2025-52289

A Broken Access Control vulnerability exists in MagnusBilling versions prior to v7.8.5.3 . The flaw allows newly registered users to escalate privileges by sending a crafted request to the /mbilling/index.php/user/save endpoint, enabling them to change their account status from pending to active ...

CVE-2024-7747

The Wallet for WooCommerce plugin for WordPress is vulnerable to incorrect conversion between numeric types in all versions up to, and including, 1.5.6. This is due to a numerical logic flaw when transferring funds to another user. This makes it possible for authenticated attackers, with...

CVE-2024-7747 Wallet for WooCommerce <= 1.5.6 - Authenticated (Subscriber+) Incorrect Conversion between Numeric Types

The Wallet for WooCommerce plugin for WordPress is vulnerable to incorrect conversion between numeric types in all versions up to, and including, 1.5.6. This is due to a numerical logic flaw when transferring funds to another user. This makes it possible for authenticated attackers, with...