Lucene search
+L

1259874 matches found

NVD
NVD
added 2026/09/17 6:16 a.m.7 views

CVE-2026-90923

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...

6.5CVSS0.00164EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/17 6:16 a.m.9 views

CVE-2026-87836

The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commente...

2.7CVSS0.00189EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/17 6:16 a.m.8 views

CVE-2026-86446

The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns when a quiz answer is checked, allowing unauthenticated attackers to obtain the correct answer to every option of a question, along with the instructor's explanation, on courses configured to be taken...

3.7CVSS0.00178EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/17 6:00 a.m.20 views

CVE-2026-91019

Event Booking Manager for WooCommerce (also identified as WpEvently ) before version 5.6.0 contains an improper access control flaw: the plugin's stored payment gateway configuration is not restricted by user role. As a result, any user with Contributor-level access or above can read the site's P...

0.00222EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/17 6:00 a.m.31 views

CVE-2026-91019 Event Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential Disclosure

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...

0.00222EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/17 6:00 a.m.11 views

EUVD-2026-81358

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...

4.9CVSS0.00222EPSS
SaveExploits0References1
Patchstack
Patchstack
added 2026/09/17 6:00 a.m.6 views

WordPress Event Booking Manager for WooCommerce plugin < 5.6.0 - Contributor+ Payment Gateway Credential Disclosure vulnerability

Contributor+ Payment Gateway Credential Disclosure vulnerability discovered by Artus KG in WordPress Plugin WpEvently versions 5.6.0...

0.00222EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 2026/09/17 6:00 a.m.32 views

CVE-2026-91016 Motors < 1.4.121 - Unauthenticated Draft/Private Listing Disclosure

The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them, allowing unauthenticated attackers to read any author's draft, pending and private car listings - including titles, prices, media URLs and seller...

0.00193EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/17 6:00 a.m.12 views

EUVD-2026-81357

The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them, allowing unauthenticated attackers to read any author's draft, pending and private car listings - including titles, prices, media URLs and seller...

5.3CVSS0.00193EPSS
SaveExploits0References1
Patchstack
Patchstack
added 2026/09/17 6:00 a.m.7 views

WordPress Motors plugin < 1.4.121 - Unauthenticated Draft/Private Listing Disclosure vulnerability

Unauthenticated Draft/Private Listing Disclosure vulnerability discovered by Pedro Pinho in WordPress Plugin Motors versions 1.4.121...

0.00193EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2026/09/17 6:00 a.m.17 views

CVE-2026-91016

The Motors WordPress plugin (a car dealership classified listings plugin) before version 1.4.121 contains an unauthorized disclosure vulnerability . The plugin fails to verify whether a request is authorized to view a user's non-published listings, allowing unauthenticated attackers to read any a...

0.00193EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/17 6:00 a.m.10 views

EUVD-2026-81351

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information full name, email address, phone...

3.7CVSS0.00166EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/17 6:00 a.m.17 views

CVE-2026-90923

CVE-2026-90923 affects the Autopay WordPress plugin in versions before 5.0.1 . The root cause is a missing signature enforcement on one of its payment callback endpoints, which allows unauthenticated users to disclose and delete the stored payment parameters of other customers' orders. The vulner...

0.00164EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/09/17 6:00 a.m.12 views

CVE-2026-90923 Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...

0.00164EPSS
SaveExploits0References1
Patchstack
Patchstack
added 2026/09/17 6:00 a.m.7 views

WordPress Event Booking Manager for WooCommerce plugin 5.3.6-5.3.7 - Unauthenticated Attendee PII Disclosure vulnerability

Unauthenticated Attendee PII Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin WpEvently versions 5.3.6-5.3.7...

0.00166EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2026/09/17 6:00 a.m.15 views

CVE-2026-91008

Event Booking Manager for WooCommerce (WpEvently) WordPress plugin versions before 5.3.8 (specifically 5.3.6–5.3.7) fail to perform an ownership or authorization check before rendering booking confirmation details. This allows unauthenticated attackers to retrieve registered attendees' personal i...

0.00166EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/17 6:00 a.m.32 views

CVE-2026-90923 Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...

0.00164EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/17 6:00 a.m.7 views

EUVD-2026-81350

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...

6.5CVSS0.00164EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/17 6:00 a.m.32 views

CVE-2026-87836 Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export

The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commente...

0.00189EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/17 6:00 a.m.15 views

CVE-2026-87836

The Comments Import & Export WordPress plugin (versions 2.1.11–2.5.3 ) contains an insufficient permissions check in its comment export feature. The export is neither restricted to users with comment-moderation capabilities nor scoped to content owned by the requesting user, so any user with the ...

0.00189EPSS
SaveExploits0References1
Rows per page
Query Builder