WordPress Sensei LMS <4.5.0 - Information Disclosure

WordPress Sensei LMS plugin before 4.5.0 is susceptible to information disclosure. The plugin does not have proper permissions set in a REST endpoint, which can allow an attacker to access private messages. id: CVE-2022-2034 info: name: WordPress Sensei LMS 4.5.0 - Information Disclosure author:...

WooCommerce Payments - Unauthorized Admin Access

An issue in WooCommerce Payments plugin for WordPress versions 5.6.1 and lower allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the...

Automattic Sensei LMS Authorization Issue Vulnerability

Automattic Sensei LMS versions prior to 4.26.4 have an authorization issue vulnerability. This vulnerability stems from improper access control in the AJAX handler for addnewmoduleterm. Only a generic nonce is verified, and only checks are performed for slug prefixes in manageoptions, without...

Automattic Sensei LMS Authorization Issue Vulnerability

Automattic Sensei LMS versions prior to 4.26.4 have an authorization issue vulnerability. This vulnerability stems from the old savenewmessage processing routine, which relies on the init action hook. This routine only verifies a generic nonce; it does not verify course registration or limit post...

CVE-2026-106608 WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from 9.8.0 through 11.1.2...

CVE-2026-106601: Authentication Bypass Using an Alternate Path or Channel

Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2...

Linux Distros Unpatched Vulnerability : CVE-2026-66666

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress:...

CVE-2026-66666: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6...

UBUNTU-CVE-2026-93485

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1...

EUVD-2026-82657

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Automattic WordPress core allows DOM-Based XSS. This issue affects WordPress versions 7.1 before 7.1.1; 7.0 through 7.0.4; 6.9 through 6.9.7; 6.8 through 6.8.8; 6.7 through 6.7.7; 6.6 through 6.6.7...

CVE-2026-93485

Automattic WordPress core (versions 4.7 through 7.1) is affected by a DOM-Based XSS vulnerability in input neutralization during web page generation. The vulnerability is unauthenticated and reproducible on a default WordPress installation: comment moderation is disabled by default, and the requi...

Linux Distros Unpatched Vulnerability : CVE-2026-93485

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This iss...

CVE-2026-48888

Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS. This issue affects WooCommerce: from n/a before 11.1.0...

EUVD-2026-72651

Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS. This issue affects WooCommerce: from n/a before 11.1.0...

CVE-2026-48888 WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability

Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS. This issue affects WooCommerce: from n/a before 11.1.0...

PT-2026-86995

Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS. This issue affects WooCommerce: from n/a before 11.1.0...

CVE-2026-57777

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Automattic WooCommerce allows Blind SQL Injection. This issue affects WooCommerce: from n/a before 11.0...

CVE-2026-57777

Automattic WooCommerce (WordPress plugin) versions prior to 11.0 are affected by a Blind SQL Injection vulnerability in the plugin's handling of special elements in SQL commands. The vulnerability is rated CVSS 3.1: 7.6 (HIGH) , with an attack vector of network , low complexity , and high privile...

CVE-2026-57777 WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Automattic WooCommerce allows Blind SQL Injection. This issue affects WooCommerce: from n/a before 11.0...

EUVD-2026-70971

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Automattic WooCommerce allows Blind SQL Injection. This issue affects WooCommerce: from n/a before 11.0...