WordPress Booster Elite for WooCommerce plugin < 8.4.0 - Authenticated Arbitrary WordPress Option Disclosure vulnerability

Authenticated Arbitrary WordPress Option Disclosure vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Booster Elite for WooCommerce versions 8.4.0...

CVE-2026-78355

A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory. This may allow files accessible to the OTRS application process to be deleted. The vulnerability does not bypass operating syste...

CVE-2026-78355

A path traversal vulnerability exists in the OTRS SendSupportBundle functionality, allowing an authenticated administrator to reference file paths outside the intended directory. This flaw enables the deletion of files accessible to the OTRS application process, subject to operating system file p...

CVE-2026-78355 Path Traversal in SendSupportBundle allows File Deletion Outside the Intended Directory

A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory. This may allow files accessible to the OTRS application process to be deleted. The vulnerability does not bypass operating syste...

CVE-2026-84167

The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referenci...

CVE-2026-107791

The WP Comment Cleaner WordPress plugin (versions before 7.2 ) is vulnerable to an authorization bypass due to a missing capability check and nonce validation on a bulk comment-deletion routine (specifically via nav_delete_all_comment). This allows authenticated users with minimal permissions, su...

EUVD-2026-97244

The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site...

EUVD-2026-97242

The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referenci...

CVE-2026-108980

Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerTrpc/plugin.ts, and the plugin.installPlugin tRPC procedure is open to any authenticated user. Thus, a name containing...

PT-2026-111108

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity XXE injection flaw...

PT-2026-111037

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.120.0 Frappe ERPNext versions 16.x prior to 16.33.0 Description Certain endpoints fail to enforce proper permission checks, leading to a missing authorization issue. This allows authenticated users with low...

PT-2026-110474

The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site...

PT-2026-110479

Name of the Vulnerable Software and Affected Versions Hotel Booking versions prior to 3.9 Description An Insecure Direct Object Reference IDOR exists where the software fails to verify if a booking record belongs to the user requesting it. This allows any authenticated user, such as a Subscriber,...

PT-2026-110487

Name of the Vulnerable Software and Affected Versions OTRS versions 6.x and earlier OTRS versions 7.0.x through 2026.6.x Description A path traversal issue in the SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory. This can...

PT-2026-110622

Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to inject scripts by storing unescaped URLs in ExternalImage fields. Attackers with data object edit permission can store attribute-breaking payloads that execute JavaScript in th...

PT-2026-110637

🚨 CVE-2026-109194 A flaw was found in Red Hat Quay. The build trigger management application programming interface API fails to verify whether a requested trigger belongs to the specified repository. An authenticated user with administrative access to any repository can view, modify, or permanent...

PT-2026-110615

Name of the Vulnerable Software and Affected Versions Thelia version 2.6.0 Description Authenticated administrators can upload and install modules using the ZIP upload function. The system fails to validate or sandbox embedded PHP code, allowing an attacker to include malicious code within a...

PT-2026-110613

Name of the Vulnerable Software and Affected Versions Thelia version 2.6.0 Description Reflected Cross-Site Scripting XSS occurs because Smarty templates address.html and address-update.html do not properly escape double quotes in the next parameter. This allows an attacker to execute arbitrary...

PT-2026-110556

Name of the Vulnerable Software and Affected Versions TDuck survey form versions prior to 6.1 Description Broken access control allows authenticated users to add fields to forms belonging to other users. By sending a request to the endpoint "POST /user/form/item/batch/create", an attacker can...

PT-2026-110555

TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supplying arbitrary submission ids. Attackers can place their own formKey in the path and iterate sequential submission ids in the...