CVE-2026-87888

The YayPricing WordPress plugin (versions before 3.5.7 ) is affected by a stored XSS vulnerability. The root cause is a missing authorization check on the save_page_data REST route used to save pricing rules. Any authenticated user with the subscriber role or higher can inject arbitrary JavaScrip...

EUVD-2026-76786

The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in...

CVE-2026-77752

CVE-2026-77752 is a privilege escalation vulnerability in the Temporary Login Without Password WordPress plugin (versions 1.5 through 1.9.8 ). The plugin fails to verify that the user requesting a temporary login already holds network super admin rights before granting those rights to the new or ...

CVE-2026-80494 Yogeta WP Cloud <= 1.0 - Unauthenticated Arbitrary File Download

The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-supplied file path before passing it to a file-read function on a public endpoint that lacks any authorization check, allowing unauthenticated attackers to download arbitrary files from the server, including files containin...

CVE-2026-77705 Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the...

CVE-2026-77705

CVE-2026-77705 affects the Booking for Appointments and Events Calendar (Amelia) WordPress plugin in versions before 2.4.10 . The root cause is a missing authorization check: when a user with Amelia's customer or employee management permissions edits a record, the plugin does not verify that the ...

Chromium CVE-2026-76019: Incorrect authorization in Workers

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

EUVD-2026-76743

The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather than defaulting to deny. Any request handler that is not explicitly registered in this table is reachable by any authenticated user...

EUVD-2026-76746

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this...

PT-2026-90637

MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it for access tokens...

PT-2026-90560

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the...

PT-2026-90586

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates...

PT-2026-90643

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in playlistsFromUser.json.php that allows unauthenticated attackers to read private playlists by requesting another user's identifier. Attackers can retrieve Favorite and Watch Later...

PT-2026-90641

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to authorize access to the adsInfo API endpoint, allowing unauthenticated attackers to retrieve password-protected video owner identifiers. Attackers can call the adsInfo API with a videos id parameter to obtain the owner's...

openSUSE 16: containerized-data-importer1.65-api / etc (openSUSE-SU-2026:21824-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21824-1 advisory. - CVE-2025-22869: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh bsc1239322. - CVE-2025-22870: golang.org/x/net/proxy: proxy...

PT-2026-90642

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php that allows unauthenticated attackers to access scheduler email jobs by providing a site-wide daily token. Attackers can enumerate scheduler...

PT-2026-90655

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to check user authorization in the PlayerSkins mediaSession.json.php endpoint before returning video metadata. Unauthenticated attackers can request the endpoint with a video ID parameter to retrieve password-protected vide...

PT-2026-90583

The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actions, allowing any authenticated user such as a subscriber to overwrite private notes on records belonging to other user...

PT-2026-90585

The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin befor...

PT-2026-90561

The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rights, allowing an administrator of a single site on a multisite network to take over the whole...