9228 matches found
CVE-2026-2278
The VW Writer Blog theme for WordPress is affected by a missing capability check on the vw_writer_blog_reset_all_settings function in all versions up to and including 1.3.8 . Authenticated users with Subscriber-level access or above can call this function to reset all theme customizer settings to...
CVE-2026-2278 VW Writer Blog <= 1.3.8 - Missing Authorization to Authenticated (Subscriber+) Theme Settings Reset
The VW Writer Blog theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'vwwriterblogresetallsettings' function in all versions up to, and including, 1.3.8. This makes it possible for authenticated attackers, with Subscriber-level access...
CVE-2026-2278 VW Writer Blog <= 1.3.8 - Missing Authorization to Authenticated (Subscriber+) Theme Settings Reset
The VW Writer Blog theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'vwwriterblogresetallsettings' function in all versions up to, and including, 1.3.8. This makes it possible for authenticated attackers, with Subscriber-level access...
PT-2026-95785
Name of the Vulnerable Software and Affected Versions VW Writer Blog theme for WordPress versions prior to 1.3.9 Description The software allows unauthorized modification of data because the vw writer blog reset all settings function lacks a proper capability check. Authenticated users with...
CVE-2026-2278: Missing Authorization
The VW Writer Blog theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'vwwriterblogresetallsettings' function in all versions up to, and including, 1.3.8. This makes it possible for authenticated attackers, with Subscriber-level access...
Why Small Businesses Shouldn’t Go It Alone With Cloud Migration
Moving business systems to the cloud can look straightforward from the outside. Choose a provider, transfer the data…...
Local Presence, Global Reach: How Virtual Numbers Support International Customer Communication
Expanding into another country creates a practical communication problem for businesses. Customers may be thousands of miles away,…...
WordPress PuppyFW plugin <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation vulnerability
Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation vulnerability discovered by Naoki Kawahigashi in WordPress Plugin PuppyFW versions = 0.4.4...
PT-2026-95270
Name of the Vulnerable Software and Affected Versions The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress versions prior to 1.8.7 Description An authorization bypass exists because the plugin fails to properly...
CVE-2026-75017: Missing Authorization
The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.6. This is due to the plugin not properly verifying that a user is authorized t...
CVE-2026-88904
The PuppyFW WordPress plugin (versions
CVE-2026-88904 PuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation
The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby...
CVE-2026-88904 PuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation
The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby...
PT-2026-94172
Name of the Vulnerable Software and Affected Versions PuppyFW versions prior to 0.4.5 Description Insufficient authorization on a REST route allows any authenticated user, including those with subscriber roles, to add, modify, or delete arbitrary blog options. This occurs because the plugin...
CVE-2026-88904: Improper Privilege Management
The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby...
Upcoming Speaking Engagements
This is a current list of where and when I am scheduled to speak: I’m speaking online via Zoom at a League of Women Voters event on Tuesday, September 22, 2026 at 5 PM ET. I’m speaking at CanSecWest 2026 in Vancouver, Canada. The conference runs September 30–October 1, 2026; the time of my talk i...
CVE-2023-51769
Frappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages...
CVE-2026-80132
creationtimestamp| type| source ---|---|--- 2026-09-14 03:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mvh6myvkcu2u...
