CVE-2026-14188

The CVE-2026-14188 details a vulnerability in the Easy Appointments WordPress plugin (versions up to 3.12.26) where a customer-listing handler does not perform a per-request capability check or nonce verification. This allows authenticated users with contributor-level access to read every stored ...

CVE-2026-14188 Easy Appointments < 3.12.28 - Contributor+ Customer Data Disclosure

The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information...

CVE-2026-14223 Easy Appointments < 3.12.28 - Subscriber+ Customer PII Disclosure via IDOR

The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier...

PT-2026-66607

Name of the Vulnerable Software and Affected Versions Sylius Mollie Plugin versions prior to 2.2.8 Sylius Mollie Plugin versions prior to 3.2.4 Sylius Mollie Plugin versions prior to 3.3.1 Description The software fails to perform ownership or session checks when looking up sequential orderId...

PT-2026-66501

Name of the Vulnerable Software and Affected Versions foreUP affected versions not specified Description An issue in the customer REST API allows an authenticated user with low privileges to access an endpoint that returns records belonging to other users. This occurs because the system fails to...

PT-2026-66500

Name of the Vulnerable Software and Affected Versions foreUP affected versions not specified Description A flaw in the customer REST API allows any authenticated user to retrieve cleartext payment-processor merchant credentials within the response body. Recommendations At the moment, there is no...

CVE-2025-69947

CVE-2025-69947 affects SourceCodester Tailor Management System 1.0, with a vulnerability in the PHP component customeredit.php?id=1 that allows SQL Injection. The CVSS 3.1 score is 9.8 (CRITICAL) with network attack vector, no authentication, and high impacts to confidentiality, integrity, and av...

EUVD-2026-43723

Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync...

EUVD-2026-43692

Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page...

CVE-2026-14224

The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A subscriber-lev...

CVE-2026-11841 CVE-2026-11841

An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access witho...

CVE-2026-11841 CVE-2026-11841

An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access witho...

EUVD-2026-49689

The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax function and the serveTemplatePdf REST route which is registered...

CVE-2026-12124

The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax function and the serveTemplatePdf REST route which is registered...

CVE-2026-9830 BookingPress Pro < 5.7.3 - Unauthenticated Customer PII Disclosure and Booking Tampering via Permission Callback Bug

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other...

CVE-2026-9830

CVE-2026-9830 affects BookingPress Appointment Booking Pro for WordPress prior to 5.7.3. The root cause is a REST permission callback not being invoked, leaving all routes in a REST API namespace accessible without authentication. This allows unauthenticated attackers to read customer booking dat...

CVE-2026-13400 Simply Schedule Appointments < 1.6.12.4 - Unauthenticated Stored XSS via Booking Customer Information

Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply...

CVE-2026-65760

Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system...

CVE-2026-65760

Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system...

EUVD-2026-48313

Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system...