CVE-2026-104648

The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credential usable without a WordPress session to...

CVE-2026-104648 weMail <= 2.1.6 - Editor+ API Key Disclosure

The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credential usable without a WordPress session to...

EUVD-2026-115683

The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credential usable without a WordPress session to...

CVE-2026-104648

The weMail WordPress plugin (versions through 2.1.6 ) contains an API Key Disclosure vulnerability. The plugin fails to restrict access to a site-wide third-party email-service API key to administrators, exposing it on an admin screen accessible by users with the Editor role. An attacker with Edi...

Exploit for CVE-2026-100105

CVE-2026-100105 — Grafana Alerting Contact Point Authorization...

CVE-2026-72585-PoC

CVE-2026-72585 — Grafana: Incomplete Fix for CVE-2026-21724 Allows Editor Role to Delete Protected Contact Points Product: Grafana Grafana Labs — through 13.2.0 File: pkg/services/ngalert/provisioning/contactpoints.go CWE: CWE-284 — Improper Access Control CVSS 3.1:...

CVE-2026-111027

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and strips the escaping it had applied before running the query, allowing users with the Editor role or higher to perform SQL injection attacks...

CVE-2026-111027

The Welcart e-Commerce WordPress plugin versions prior to 2.12.6 is vulnerable to SQL injection . The root cause is the failure to properly sanitize and escape a parameter before its use in a SQL query; specifically, the plugin strips previously applied escaping before execution. This flaw allows...

CVE-2026-111027 Welcart e-Commerce < 2.12.6 - Editor+ SQLi via 'log_id' Parameter

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and strips the escaping it had applied before running the query, allowing users with the Editor role or higher to perform SQL injection attacks...

EUVD-2026-111716

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and strips the escaping it had applied before running the query, allowing users with the Editor role or higher to perform SQL injection attacks...

CVE-2026-111027: Unknown Welcart e-Commerce: The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it…

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and strips the escaping it had applied before running the query, allowing users with the Editor role or higher to perform SQL injection attacks...

PT-2026-127841

The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, so a forged cross-site request can cause a logged-in user with the Editor role or above to permanently delete every trashed attachment on the site...

PT-2026-127833

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and strips the escaping it had applied before running the query, allowing users with the Editor role or higher to perform SQL injection attacks...

EUVD-2026-109212

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg Register block passing the attacker-controlled Assigned Role...

EUVD-2026-108598

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint, checking only the client-supplied MIME type and a case-sensitive block of the .php extension, which allows users with the Editor role and above to...

PT-2026-121771

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint, checking only the client-supplied MIME type and a case-sensitive block of the .php extension, which allows users with the Editor role and above to...

CVE-2026-110982

The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and excerpt, allowing users with the Editor role and above to modify arbitrary posts of any type, including content they cannot otherwise edit such as...

CVE-2026-110982

The AI Engine WordPress plugin (versions prior to 3.8.6 ) is vulnerable to a missing authorization check when updating post titles and excerpts. Users with the Editor role or higher can exploit this to modify arbitrary posts of any type, including restricted content such as navigation menus, bloc...

CVE-2026-110982 AI Engine < 3.8.6 - Editor+ Arbitrary Post Title and Excerpt Update via update_post_title and update_post_excerpt

The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and excerpt, allowing users with the Editor role and above to modify arbitrary posts of any type, including content they cannot otherwise edit such as...

EUVD-2026-107071

The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and excerpt, allowing users with the Editor role and above to modify arbitrary posts of any type, including content they cannot otherwise edit such as...