WordPress Tutor LMS plugin 4.0.0-4.0.7 - Subscriber+ Cross-Course Lesson Comment Disclosure vulnerability

Subscriber+ Cross-Course Lesson Comment Disclosure vulnerability discovered by Shirshak in WordPress Plugin Tutor LMS versions 4.0.0-4.0.7...

CVE-2026-82125 Schema & Structured Data for WP & AMP 1.46 - 1.65 - Unauthenticated Non-Public Comment Content Disclosure via IDOR

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not correctly verify the ownership or the moderation status of a comment before returning its content, allowing unauthenticated users to read the content of comments still awaiting moderation or marked as spam...

CVE-2026-82125 Schema & Structured Data for WP & AMP 1.46 - 1.65 - Unauthenticated Non-Public Comment Content Disclosure via IDOR

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not correctly verify the ownership or the moderation status of a comment before returning its content, allowing unauthenticated users to read the content of comments still awaiting moderation or marked as spam...

EUVD-2026-80188

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not correctly verify the ownership or the moderation status of a comment before returning its content, allowing unauthenticated users to read the content of comments still awaiting moderation or marked as spam...

CVE-2026-82125

The Schema & Structured Data for WP & AMP WordPress plugin (versions 1.46–1.65 ) contains an IDOR (Insecure Direct Object Reference) vulnerability in its comment-handling endpoint. The plugin fails to correctly verify ownership or moderation status of a comment before returning its content, allow...

CVE-2026-19704

The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read comments they are not entitled to see, including comments awaiting moderation, comments marked as spam or trashed, and comments on private an...

WordPress Comments plugin < 7.6.66 - Unauthenticated Comment Disclosure vulnerability

Unauthenticated Comment Disclosure vulnerability discovered by Jakub Herman in WordPress Plugin wpDiscuz versions 7.6.66...

EUVD-2026-69862

The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read comments they are not entitled to see, including comments awaiting moderation, comments marked as spam or trashed, and comments on private an...

CVE-2026-19704

The wpDiscuz WordPress plugin (versions before 7.6.66 ) is vulnerable to an SQL injection because it fails to validate a value used in a database query. This flaw allows unauthenticated users to read comments they are not authorized to view, such as those awaiting moderation, marked as spam, tras...

CVE-2026-19704 Comments – wpDiscuz < 7.6.66 - Unauthenticated Comment Disclosure via SQLi

The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read comments they are not entitled to see, including comments awaiting moderation, comments marked as spam or trashed, and comments on private an...

CVE-2026-19704 Comments – wpDiscuz < 7.6.66 - Unauthenticated Comment Disclosure via SQLi

The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read comments they are not entitled to see, including comments awaiting moderation, comments marked as spam or trashed, and comments on private an...

WordPress Ultimate Member plugin < 2.13.0 - Unauthenticated Unapproved Comment Disclosure vulnerability

Unauthenticated Unapproved Comment Disclosure vulnerability discovered by Alessandro Greco aka Aleff, Giovambattista Ianni University of Calabria - UNICAL in WordPress Plugin Ultimate Member versions 2.13.0...

CVE-2026-19251 Ultimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile Activity

The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation...

CVE-2026-19251

The Ultimate Member WordPress plugin, in versions prior to 2.13.0 , is vulnerable to an unauthenticated disclosure of unapproved comments. The root cause is a failure to verify if a comment has been approved or if the associated profile is private before returning profile activity to unauthentica...

CVE-2026-19251 Ultimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile Activity

The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation...

CVE-2026-66797 Apache CloudStack: Unauthorised comment creation and disclosure

Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user...

WordPress Sunshine Photo Cart plugin < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure vulnerability

Unauthenticated Private Gallery Comment Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin Sunshine Photo Cart versions 3.6.12...

CVE-2009-2431

WordPress 2.7.1 places the username of a post's author in an HTML comment, which allows remote attackers to obtain sensitive information by reading the HTML source...

CVE-2009-2431

CVE-2009-2431 affects WordPress 2.7.1, where the author’s username is placed in an HTML comment. This allows remote attackers to read the HTML source and harvest author identifiers (sensitive information). The underlying issue is information disclosure via HTML comments in the post output. Remedi...

CVE-2009-2431

WordPress 2.7.1 places the username of a post's author in an HTML comment, which allows remote attackers to obtain sensitive information by reading the HTML source...