CVE-2026-118530

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not check that the acting user may edit each targeted user when handling an email-verification bulk action on multisite, allowing an Administrator of one site on the network to lock out use...

CVE-2026-118530

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin (versions prior to 8.11 ) is vulnerable to a cross-site account lockout. The root cause is a failure to verify if an acting user has permission to edit specific target users during an email-verification bul...

EUVD-2026-118936

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not check that the acting user may edit each targeted user when handling an email-verification bulk action on multisite, allowing an Administrator of one site on the network to lock out use...

CVE-2026-113485

The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present, so a forged request that omits the field can cause a logged-in user with the Author role or above to...

CVE-2026-113485

The Media Library Assistant WordPress plugin (versions before 3.42 ) is vulnerable to a Cross-Site Request Forgery (CSRF) flaw. The vulnerability exists because the Media Library bulk-action handler fails to consistently validate its CSRF nonce, specifically checking it only when the field is pre...

CVE-2026-113485 Media Library Assistant < 3.42 - Bulk Attachment Deletion via CSRF

The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present, so a forged request that omits the field can cause a logged-in user with the Author role or above to...

EUVD-2026-111723

The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present, so a forged request that omits the field can cause a logged-in user with the Author role or above to...

CVE-2026-113485: Unknown Media Library Assistant: The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media…

The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present, so a forged request that omits the field can cause a logged-in user with the Author role or above to...

PT-2026-127840

The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present, so a forged request that omits the field can cause a logged-in user with the Author role or above to...

PT-2026-116364

Name of the Vulnerable Software and Affected Versions User Registration & Membership versions prior to 5.2.9 Description This issue involves Cross-Site Request Forgery, a flaw where an attacker tricks a victim into performing actions they did not intend to. Unauthenticated attackers can force...

PT-2026-113594

The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary non-form-tag submission fields in its db7 forms row and the process bulk action delete handler then...

EUVD-2026-85647

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-controlled acc.Name value into an Elasticsearch bulk JSON and NDJSON request without escaping it. The SetAccountName transaction accepts val...

PT-2026-90541

Name of the Vulnerable Software and Affected Versions Shopper versions prior to 2.9.2 Description An authorization bypass exists in the packages/admin/src/Livewire/Components/Collection/CollectionProducts.php component. The Action::make'delete' and DeleteBulkAction::make functions lack proper...

PT-2026-89280

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulk action parameter in all versions up to, and including, 1.15.46 due to insufficient input sanitization and output escaping. This makes it...

Incorrect Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Incorrect Authorization due to inconsistent authorization checks in multiple API endpoints and bulk action web routes. An attacker can access, modify, or delete user data...

CVE-2026-7444

The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missing or incorrect nonce validation on the processbulkaction function of MWTSAStatsTable. This makes it possible for unauthenticated attacker...

EUVD-2026-53184

The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missing or incorrect nonce validation on the processbulkaction function of MWTSAStatsTable. This makes it possible for unauthenticated attacker...

CVE-2026-7444 Search Analytics for WP <= 1.4.16 - Cross-Site Request Forgery

The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missing or incorrect nonce validation on the processbulkaction function of MWTSAStatsTable. This makes it possible for unauthenticated attacker...

CVE-2026-7444

CVE-2026-7444 affects the WordPress plugin Search Analytics for WP (

PT-2026-68055

Name of the Vulnerable Software and Affected Versions Search Analytics for WP versions prior to 1.4.17 Description The plugin is susceptible to Cross-Site Request Forgery CSRF, a flaw where an attacker tricks a victim into performing actions they did not intend to. This occurs due to missing or...