CVE-2026-6701

creationtimestamp| type| source ---|---|--- 2026-05-08 18:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mleekftnto2a...

CVE-2026-6701 addfreespace <= 0.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page

The addfreespace plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scrip...