85 matches found
CVE-2026-119751
Content Egg plugin for WordPress before 12.1.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve Content Egg product data from unpublished posts by calling the REST route POST /wp-json/content-egg/v1/render-blocks, whose permissioncheck improperly...
CVE-2026-119751 Content Egg WordPress Plugin < 12.1.0 Unauthenticated Information Disclosure via render-blocks
Content Egg plugin for WordPress before 12.1.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve Content Egg product data from unpublished posts by calling the REST route POST /wp-json/content-egg/v1/render-blocks, whose permissioncheck improperly...
CVE-2026-119751
The Content Egg plugin for WordPress before version 12.1.0 is vulnerable to an unauthenticated information disclosure due to broken access control. The issue resides in the permission_check() function of the REST route POST /wp-json/content-egg/v1/render-blocks, which incorrectly returns true if ...
EUVD-2026-117550
Content Egg plugin for WordPress before 12.1.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve Content Egg product data from unpublished posts by calling the REST route POST /wp-json/content-egg/v1/render-blocks, whose permissioncheck improperly...
CVE-2026-119059
The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts function in versions up to, and including, 12.0.0. The handler verifies a static nonce 'contenteggmetabox' and the generic 'editposts'...
CVE-2026-119087
The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 12.0.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-119087 Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Author+) Administrator-Authored Post Creation via 'preset_id' Parameter
The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 12.0.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
EUVD-2026-113716
The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts function in versions up to, and including, 12.0.0. The handler verifies a static nonce 'contenteggmetabox' and the generic 'editposts'...
CVE-2026-119087 Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Author+) Administrator-Authored Post Creation via 'preset_id' Parameter
The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 12.0.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
EUVD-2026-113717
The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 12.0.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-119059 Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Meta Modification via 'post_id' Parameter via cegg_update_products AJAX Action
The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts function in versions up to, and including, 12.0.0. The handler verifies a static nonce 'contenteggmetabox' and the generic 'editposts'...
CVE-2026-119059 Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Meta Modification via 'post_id' Parameter via cegg_update_products AJAX Action
The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts function in versions up to, and including, 12.0.0. The handler verifies a static nonce 'contenteggmetabox' and the generic 'editposts'...
CVE-2026-119087
The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to an authorization bypass in versions up to and including 12.0.0 . The root cause is the plugin's failure to properly verify user permissions when processing the preset_id parameter. This allows au...
CVE-2026-119059
The Content Egg plugin for WordPress (versions up to and including 12.0.0 ) is vulnerable to unauthorized data modification. The ajaxUpdateProducts() function fails to perform a per-object capability check (e.g., current_user_can('edit_post', $post_id)) on the post_id parameter, despite verifying...
PT-2026-133282
The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 12.0.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
PT-2026-133281
The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts function in versions up to, and including, 12.0.0. The handler verifies a static nonce 'contentegg metabox' and the generic 'edit posts'...
CVE-2026-119087: keywordrush Content Egg – Affiliate Product Importer & Price Comparison: The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to authorization…
The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 12.0.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
WordPress Content Egg Cross Site Scripting
WordPress Content Egg versions before 11.9.0 contain a stored cross site scripting vulnerability that lets Contributor-level users enqueue unescaped content through an administrator-owned import preset. https://packetstorm.news/download/238560...
CVE-2026-119059: keywordrush Content Egg – Affiliate Product Importer & Price Comparison: The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post…
The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts function in versions up to, and including, 12.0.0. The handler verifies a static nonce 'contenteggmetabox' and the generic 'editposts'...
