1259864 matches found
CVE-2026-91016
The Motors WordPress plugin (a car dealership classified listings plugin) before version 1.4.121 contains an unauthorized disclosure vulnerability . The plugin fails to verify whether a request is authorized to view a user's non-published listings, allowing unauthenticated attackers to read any a...
EUVD-2026-81351
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information full name, email address, phone...
CVE-2026-90923
CVE-2026-90923 affects the Autopay WordPress plugin in versions before 5.0.1 . The root cause is a missing signature enforcement on one of its payment callback endpoints, which allows unauthenticated users to disclose and delete the stored payment parameters of other customers' orders. The vulner...
CVE-2026-90923 Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion
The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...
WordPress Event Booking Manager for WooCommerce plugin 5.3.6-5.3.7 - Unauthenticated Attendee PII Disclosure vulnerability
Unauthenticated Attendee PII Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin WpEvently versions 5.3.6-5.3.7...
CVE-2026-91008
Event Booking Manager for WooCommerce (WpEvently) WordPress plugin versions before 5.3.8 (specifically 5.3.6–5.3.7) fail to perform an ownership or authorization check before rendering booking confirmation details. This allows unauthenticated attackers to retrieve registered attendees' personal i...
CVE-2026-90923 Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion
The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...
EUVD-2026-81350
The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...
CVE-2026-87836 Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export
The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commente...
CVE-2026-87836
The Comments Import & Export WordPress plugin (versions 2.1.11–2.5.3 ) contains an insufficient permissions check in its comment export feature. The export is neither restricted to users with comment-moderation capabilities nor scoped to content owned by the requesting user, so any user with the ...
EUVD-2026-81345
The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commente...
WordPress Newsletter plugin < 9.3.8 - Unauthenticated Subscriber PII Disclosure and Modification vulnerability
Unauthenticated Subscriber PII Disclosure and Modification vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Newsletter versions 9.3.8...
WordPress Comments Import & Export plugin 2.1.11-2.5.3 - Author+ Comment PII Disclosure vulnerability
Author+ Comment PII Disclosure vulnerability discovered by a0yark in WordPress Plugin Comments Import & Export versions 2.1.11-2.5.3...
CVE-2026-86446
LearnPress is a WordPress plugin for course creation. Versions 4.4.3 through 4.4.6 fail to restrict the correctness flags returned by the check-answer REST endpoint , allowing unauthenticated attackers to retrieve the correct answer for every option of a quiz question, along with the instructor's...
CVE-2026-86446 LearnPress 4.4.3 - 4.4.6 - Unauthenticated Quiz Answer Disclosure via check-answer REST Endpoint
The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns when a quiz answer is checked, allowing unauthenticated attackers to obtain the correct answer to every option of a question, along with the instructor's explanation, on courses configured to be taken...
WordPress LearnPress plugin 4.4.3-4.4.6 - Unauthenticated Quiz Answer Disclosure vulnerability
Unauthenticated Quiz Answer Disclosure vulnerability discovered by Nicat Sultanov in WordPress Plugin LearnPress versions 4.4.3-4.4.6...
EUVD-2026-81338
The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns when a quiz answer is checked, allowing unauthenticated attackers to obtain the correct answer to every option of a question, along with the instructor's explanation, on courses configured to be taken...
CVE-2025-14847-MongoBleed-Exploit
CVE-2025-14847 - MongoBleed 👨💻 Autor: Furkan KAYAPINAR @FurkanKAYAPINAR ⚠️ SOLO CON FINES EDUCATIVOS Entorno de laboratorio y script de explotación para la vulnerabilidad crítica de fuga de memoria no autenticada en MongoDB Server. 📋 Tabla de Contenidos Resumen de la Vulnerabilidad Versiones...
CVE-2025-13834-A-Bluetooth-RFCOMM-Out-of-Bounds-Read-Vulnerability-in-Modern-Wireless-Devices
= doi.org/10.5281/zenodo.18323302 = orcid.org/0009-0007-7728-256X README.md: CVE-2025-13834 RFCOMM Bluetooth "Heartbleed" Exploitation Framework Author: Sastra Adi Wiguna Purple Elite Teaming Date: January 20, 2026 Version: 1.0 Full-System Replication License: RED TEAM USE ONLY Do not distribute...
