338 matches found
CVE-2026-86842
The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be...
CVE-2026-86842 Real3D Flipbook Lite < 5.4 - Author+ Content Deletion and Stored XSS via Global Settings Overwrite
The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be...
CVE-2026-86842
The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be...
CVE-2026-81902 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block Cleanup
Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block removal panel action removeOrphanedBlocks. A remote attacker could craft a request that, when loaded by an authenticated user holding edit permission on the target page, deleted every block on that page's current...
CVE-2026-81902 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block Cleanup
Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block removal panel action removeOrphanedBlocks. A remote attacker could craft a request that, when loaded by an authenticated user holding edit permission on the target page, deleted every block on that page's current...
WordPress Classified Listing plugin < 6.1.1 - Arbitrary Content Deletion vulnerability
Arbitrary Content Deletion vulnerability discovered by Usama Arshad in WordPress Plugin Classified Listing versions 6.1.1...
CVE-2026-50173 Flow-Like: Azure invoke presign grants app content write SAS to ExecuteEvents-only users
Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, GET /api/v1/apps/appid/invoke/presign grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has ExecuteEvents, even when that member lacks ReadFiles and...
CVE-2026-73356
Unauthenticated Arbitrary Content Deletion in Breeze = 2.5.12 versions...
CVE-2026-73356 WordPress Breeze plugin <= 2.5.12 - Arbitrary Content Deletion vulnerability
Unauthenticated Arbitrary Content Deletion in Breeze = 2.5.12 versions...
CVE-2026-73356
Unauthenticated Arbitrary Content Deletion in Breeze = 2.5.12 versions...
CVE-2026-73356
The Breeze WordPress plugin (versions
PT-2026-77095
Unauthenticated Arbitrary Content Deletion in Breeze = 2.5.12 versions...
CVE-2026-18316 Solace Extra <= 1.6.0 - Missing Authorization to Unauthenticated Site Content Deletion and Unauthorized Demo Import via action-import-zip AJAX Action
The Solace Extra plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the importzip function in versions up to, and including, 1.6.0. The handler is registered on both wpajaxaction-import-zip and wpajaxnoprivaction-import-zip and on...
CVE-2026-18316 Solace Extra <= 1.6.0 - Missing Authorization to Unauthenticated Site Content Deletion and Unauthorized Demo Import via action-import-zip AJAX Action
The Solace Extra plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the importzip function in versions up to, and including, 1.6.0. The handler is registered on both wpajaxaction-import-zip and wpajaxnoprivaction-import-zip and on...
WordPress Breeze plugin <= 2.5.12 - Arbitrary Content Deletion vulnerability
Arbitrary Content Deletion vulnerability discovered by Asim Alshaya in WordPress Plugin Breeze versions = 2.5.12...
CVE-2026-28173
Customer Arbitrary Content Deletion in WP Event SOlution = 4.1.19 versions...
CVE-2026-28173 WordPress WP Event SOlution plugin <= 4.1.19 - Arbitrary Content Deletion vulnerability
Customer Arbitrary Content Deletion in WP Event SOlution = 4.1.19 versions...
CVE-2026-28173
The CVE-2026-28173 entry concerns the WordPress WP Event Solution plugin, versioned ≤ 4.1.19, with a vulnerability described as Customer Arbitrary Content Deletion. Supported details indicate a high-severity issue (CVSS 3.1: 7.1) with network attack vector, low attack complexity, and low privileg...
