WordPress User Frontend plugin < 4.3.8 - Unauthenticated Author-less Attachment Deletion vulnerability

Unauthenticated Author-less Attachment Deletion vulnerability discovered by kimsunghoon in WordPress Plugin WP User Frontend versions 4.3.8...

CVE-2026-11867

The Frontend Admin by DynamiApps WordPress plugin before 3.29.7 does not perform capability checks on its taxonomy term creation, modification, and deletion operations, allowing authenticated users with low privileges such as Subscribers to create, rename, and delete arbitrary taxonomy terms...

CVE-2026-13395

The Online Scheduling and Appointment Booking System WordPress plugin (also known as Bookly ) versions before 27.8 is vulnerable to an unauthenticated SQL injection attack. The root cause is the failure to sanitize or properly cast a user-supplied parameter—specifically identified as staff_id—wit...

CVE-2026-11867 Frontend Admin by DynamiApps < 3.29.7 - Subscriber+ Taxonomy Term Creation/Modification/Deletion via Missing Authorization

The Frontend Admin by DynamiApps WordPress plugin before 3.29.7 does not perform capability checks on its taxonomy term creation, modification, and deletion operations, allowing authenticated users with low privileges such as Subscribers to create, rename, and delete arbitrary taxonomy terms...

CVE-2026-11867

The Frontend Admin by DynamiApps WordPress plugin, in versions prior to 3.29.7 , is vulnerable to an authorization bypass. The plugin fails to perform adequate capability checks during taxonomy term creation, modification, and deletion operations. This allows authenticated users with low-level pr...

CVE-2026-11867 Frontend Admin by DynamiApps < 3.29.7 - Subscriber+ Taxonomy Term Creation/Modification/Deletion via Missing Authorization

The Frontend Admin by DynamiApps WordPress plugin before 3.29.7 does not perform capability checks on its taxonomy term creation, modification, and deletion operations, allowing authenticated users with low privileges such as Subscribers to create, rename, and delete arbitrary taxonomy terms...

CVE-2026-11867

The Frontend Admin by DynamiApps WordPress plugin before 3.29.7 does not perform capability checks on its taxonomy term creation, modification, and deletion operations, allowing authenticated users with low privileges such as Subscribers to create, rename, and delete arbitrary taxonomy terms...

EUVD-2026-51000

The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allowing unauthenticated attackers to overwrite other users' form submissions and the profile fields of the associated non-administrator...

CVE-2026-16610

The Admin and Site Enhancements ASE Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.9.0 via the recursivehtml function. This is due to the frontend save handler enforces only a publicly emitted nonce with no authentication check, CAPTCHA...

CVE-2026-11867: Missing Authorization

The Frontend Admin by DynamiApps WordPress plugin before 3.29.7 does not perform capability checks on its taxonomy term creation, modification, and deletion operations, allowing authenticated users with low privileges such as Subscribers to create, rename, and delete arbitrary taxonomy terms...

CVE-2026-14270

The Extra Checkout Options addon for Extra Product Options & Add-Ons for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the ecosavesettings function, which allows...

EUVD-2026-50296

The Extra Checkout Options addon for Extra Product Options & Add-Ons for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the ecosavesettings function, which allows...

CVE-2026-14488

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the templateredirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handlerequest function routing the mbfsdelete action without any capability or...

Security update for PackageKit

This update for PackageKit fixes the following issue: CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization bsc1267250. Special Instructions and Notes: Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

Security update for PackageKit

This update for PackageKit fixes the following issues: CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization bsc1267250. Special Instructions and Notes: Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaS...

SUSE-SU-2026:3404-1 Security update for PackageKit

This update for PackageKit fixes the following issues: - CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization bsc1267250...

CVE-2026-14488

CVE-2026-14488 affects the Meta Box AIO WordPress plugin (MB Frontend Submission extension) up to version 3.8.0. The vulnerability stems from handle_request() routing the mbfs_delete action without capability/ownership checks, and nonce verification in check_ajax() being gated behind is_ajax(), w...

CVE-2026-14488

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the templateredirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handlerequest function routing the mbfsdelete action without any capability or...

EUVD-2026-50274

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the templateredirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handlerequest function routing the mbfsdelete action without any capability or...

CVE-2026-14488 Meta Box AIO <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'rwmb_frontend_field_object_id' Parameter

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the templateredirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handlerequest function routing the mbfsdelete action without any capability or...