356 matches found
CVE-2026-96823
Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce = 5.120.0 versions...
CVE-2026-96823 WordPress Customer Reviews for WooCommerce plugin <= 5.120.0 - Arbitrary Content Deletion vulnerability
Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce = 5.120.0 versions...
CVE-2026-96823 WordPress Customer Reviews for WooCommerce plugin <= 5.120.0 - Arbitrary Content Deletion vulnerability
Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce = 5.120.0 versions...
CVE-2026-96823
The Customer Reviews for WooCommerce WordPress plugin (versions
EUVD-2026-89876
Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce = 5.120.0 versions...
CVE-2026-84302
The open-source discussion platform Discourse is vulnerable in versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 . The root cause is that reviewable visibility filtering fails to restrict Discourse AI reviewables associated with private messages. This allows moderators who are not part...
WordPress Customer Reviews for WooCommerce plugin <= 5.120.0 - Arbitrary Content Deletion vulnerability
Arbitrary Content Deletion vulnerability discovered by Matheo Beuve in WordPress Plugin Customer Reviews for WooCommerce versions = 5.120.0...
CVE-2026-86842
The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be...
CVE-2026-86842
The Real3D Flipbook WordPress plugin (versions before 5.4 ) is vulnerable to a broken access control issue because it fails to perform adequate capability checks on several authenticated flipbook management actions. This allows users with Author-level access and above to delete flipbook content b...
CVE-2026-86842 Real3D Flipbook Lite < 5.4 - Author+ Content Deletion and Stored XSS via Global Settings Overwrite
The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be...
WordPress Real3D Flipbook plugin < 5.4 - Author+ Content Deletion and Stored XSS vulnerability
Author+ Content Deletion and Stored XSS vulnerability discovered by Artus KG in WordPress Plugin Real 3D FlipBook versions 5.4...
CVE-2026-86842 Real3D Flipbook Lite < 5.4 - Author+ Content Deletion and Stored XSS via Global Settings Overwrite
The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be...
CVE-2026-81902 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block Cleanup
Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block removal panel action removeOrphanedBlocks. A remote attacker could craft a request that, when loaded by an authenticated user holding edit permission on the target page, deleted every block on that page's current...
CVE-2026-81902 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block Cleanup
Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block removal panel action removeOrphanedBlocks. A remote attacker could craft a request that, when loaded by an authenticated user holding edit permission on the target page, deleted every block on that page's current...
WordPress Classified Listing plugin < 6.1.1 - Arbitrary Content Deletion vulnerability
Arbitrary Content Deletion vulnerability discovered by Usama Arshad in WordPress Plugin Classified Listing versions 6.1.1...
CVE-2026-50173 Flow-Like: Azure invoke presign grants app content write SAS to ExecuteEvents-only users
Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, GET /api/v1/apps/appid/invoke/presign grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has ExecuteEvents, even when that member lacks ReadFiles and...
CVE-2026-73356
Unauthenticated Arbitrary Content Deletion in Breeze = 2.5.12 versions...
CVE-2026-73356 WordPress Breeze plugin <= 2.5.12 - Arbitrary Content Deletion vulnerability
Unauthenticated Arbitrary Content Deletion in Breeze = 2.5.12 versions...
