46138 matches found
CVE-2026-18059
PixelYourSite (WordPress plugin) ≤ 11.2.1 is affected by an unauthenticated Sensitive Information Exposure via the getWooPurchaseEventParams function. The issue allows any unauthenticated attacker to retrieve WooCommerce purchase metadata for any existing order by supplying an invalid or arbitrar...
CVE-2026-14839
The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished draft, pending, private, and...
CVE-2026-14822
The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders...
EUVD-2026-51739
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.5 This is due to missing or incorrect nonce validation on the reauthforauthorize function. This makes it possible for...
CVE-2026-3141
The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the /wp-json/formgent/responses/attachments REST API endpoint in all versions up to, and including, 1.9.2 This is due to the REST API route being registered without any...
CVE-2026-14839 Mapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure
The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished draft, pending, private, and...
CVE-2026-14839
The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished draft, pending, private, and...
CVE-2026-14839
CVE-2026-14839 affects Mapster WP Maps WordPress plugin (
EUVD-2026-51711
The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished draft, pending, private, and...
EUVD-2026-51709
The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders...
CVE-2026-14822 Event Tickets < 5.29.0.1 - Unauthenticated PayPal Order Status Manipulation
The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders...
CVE-2026-14822
CVE-2026-14822 affects the WordPress plugin Event Tickets and Registration prior to version 5.29.0.1. The issue is an missing authorization check on an order-management REST endpoint, allowing unauthenticated users to change the status of existing orders. The CVSS v3.1 base score is 5.3 (Medium) ...
EUVD-2026-51701
The Pixelavo WordPress plugin before 1.5.4 registers an unauthenticated AJAX action, gated only by a nonce that it emits publicly on every front-end page, that forwards client-supplied event data to the configured Facebook Conversions API using the administrator's stored access token. This allows...
CVE-2026-3141
FormGent WordPress plugin (
Tianwen-ERP-Upload-PoC
Tianwen Property ERP — Unauthenticated File Upload CVE: P...
PT-2026-67051
The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished draft, pending, private, and...
VulnCheck KEV: CVE-2024-37014
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/customcomponent" endpoint and provide a Python script...
GHSA-VVP7-H4FJ-M28W FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files
Summary The subtitlesHandler endpoint GET /api/media/subtitles accepts two user-controlled query parameters: path and name, both of which are used in filesystem operations without sanitization, creating two independent path traversal vectors. The primary vector is the path parameter: it is passed...