CVE-2026-113674

The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting i...

CVE-2026-113674 GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification

The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting i...

CVE-2026-113674

The GeoDirectory WordPress plugin (versions prior to 2.8.194 ) contains an improper access control vulnerability (CWE-284 ) where it fails to properly verify ownership of listings submitted by logged-out users. When guest posting is enabled, unauthenticated attackers can modify, unpublish, attach...

EUVD-2026-109217

The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting i...

CVE-2026-113674 GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification

The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting i...

PT-2026-122508

The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting i...

CVE-2026-96871

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'datatype' parameter in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

CVE-2026-96871 Mang Board <= 2.4.2 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'datatype' parameter in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

CVE-2026-96871

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.4.2 . The root cause is insufficient input sanitization and output escaping involving the 'data_type' parameter. This allows unauthenticated attackers to inject arbitrary w...

PT-2026-104147

Name of the Vulnerable Software and Affected Versions Mang Board versions prior to 2.4.3 Description The Mang Board plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject...

CVE-2026-96871: Improper Neutralization of Input During Web Page Generation

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'datatype' parameter in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

PT-2026-96675

Name of the Vulnerable Software and Affected Versions wpForo Forum versions prior to 3.1.6 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can...

CVE-2026-1867

The Guest posting / Frontend Posting / Front Editor WordPress plugin before 5.0.6 allows passing a URL parameter to regenerate a .json file based on demo data that it initially creates. If an administrator modifies the demo form and enables admin notifications in the Guest posting / Frontend...

CVE-2026-1867

The Guest posting / Frontend Posting / Front Editor WordPress plugin (versions before 5.0.6 ) is vulnerable to an unauthenticated sensitive information exposure vulnerability. The root cause is the ability to pass a URL parameter to regenerate a .json file based on initial demo data. If an admini...

CVE-2026-1867: Exposure of Sensitive Information to an Unauthorized Actor

The Guest posting / Frontend Posting / Front Editor WordPress plugin before 5.0.6 allows passing a URL parameter to regenerate a .json file based on demo data that it initially creates. If an administrator modifies the demo form and enables admin notifications in the Guest posting / Frontend...

PT-2026-24585

🚨 CVE-2026-1867 The Guest posting / Frontend Posting / Front Editor WordPress plugin before 5.0.6 allows passing a URL parameter to regenerate a .json file based on demo data that it initially creates. If an administrator modifies the demo form and enables admin notifications in the Guest posting...

WordPress plugin: Security vulnerabilities in Guest Posting, Frontend Posting, and Front Editor

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There wa...

CVE-2025-14080 Frontend Post Submission Manager Lite <= 1.2.5 - Missing Authorization to Unauthenticated Arbitrary Post Modification

The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.5. This is due to missing authorization checks on the post update functionality in the fpsmlformprocess AJAX action. This makes it possible for...

CVE-2025-14080

CVE-2025-14080 concerns the WordPress plugin Frontend Post Submission Manager Lite. The vulnerability is due to missing authorization on the fpsml_form_process AJAX action, allowing unauthenticated attackers to modify arbitrary posts by supplying a post_id via the guest posting form. Reported imp...

CVE-2025-12569

The Guest posting / Frontend Posting / Front Editor WordPress plugin before 5.0.0 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue...