7093 matches found
EUVD-2026-66286
The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and settings...
EUVD-2026-66283
The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be deleted, allowing users with the Shop Manager role and above to delete arbitrary files on the server, which could lead to the si...
CVE-2026-77754
The Kirki WordPress plugin before version 6.0.14 is vulnerable to unauthorized information disclosure because it fails to perform a capability check on certain endpoints of its public AJAX actions . This flaw allows unauthenticated users to retrieve sensitive data, including email addresses of re...
CVE-2026-77693 Order Tip for WooCommerce < 1.6.0 - Shop Manager+ Arbitrary File Deletion via delete_exported_csv_file_ajax
The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be deleted, allowing users with the Shop Manager role and above to delete arbitrary files on the server, which could lead to the si...
CVE-2026-77693 Order Tip for WooCommerce < 1.6.0 - Shop Manager+ Arbitrary File Deletion via delete_exported_csv_file_ajax
The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be deleted, allowing users with the Shop Manager role and above to delete arbitrary files on the server, which could lead to the si...
CVE-2026-77693
The Order Tip for WooCommerce WordPress plugin (versions before 1.6.0 ) is vulnerable to an arbitrary file deletion flaw. The plugin fails to verify the capability of the user requesting a file deletion and does not restrict the file paths targeted. This allows users with the Shop Manager role or...
CVE-2026-77754 Kirki < 6.0.14 - Unauthenticated User and Comment Author Email Disclosure via kirki_get_apis
The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and settings...
CVE-2026-77754 Kirki < 6.0.14 - Unauthenticated User and Comment Author Email Disclosure via kirki_get_apis
The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and settings...
CVE-2026-13406 Royal Elementor Addons < 1.7.1066 - Unauthenticated Taxonomy Term Disclosure
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbitrary, caller-supplied taxonomy, allowing unauthenticated users to disclose the names and IDs of terms belonging to non-public taxonomies...
PT-2026-81966
The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and settings...
PT-2026-81963
The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be deleted, allowing users with the Shop Manager role and above to delete arbitrary files on the server, which could lead to the si...
PT-2026-81943
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check relying only on a publicly-scrapeable nonce before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that...
PT-2026-81944
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbitrary, caller-supplied taxonomy, allowing unauthenticated users to disclose the names and IDs of terms belonging to non-public taxonomies...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104587)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104587 advisory. In the Linux kernel, the following vulnerability has been resolved: net: ipvti: require CAPNETADMIN in the device netns for changelink vtichangelink operates on at...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104590)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104590 advisory. In the Linux kernel, the following vulnerability has been resolved: net: sit: require CAPNETADMIN in the device netns for changelink ipip6changelink operates on at...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098887)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098887 advisory. In the Linux kernel, the following vulnerability has been resolved: net: ipgre: require CAPNETADMIN in the device netns for changelink A tunnel changelink operates o...
CVE-2026-78467
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-78272. Reason: This candidate is a reservation duplicate of CVE-2026-78272. Notes: All CVE users should reference CVE-2026-78272 instead of this candidate. All references and descriptions in this candidate have been...
CVE-2026-78467
...
CVE-2026-78467
CVE-2026-78467 is a reservation duplicate of CVE-2026-78272 and has been rejected by the CNA. The underlying vulnerability affects the Fluent Support Pro plugin for WordPress, specifically a missing capability check on a function in all versions up to and including 2.3.1 . This allows authenticat...