CVE-2026-14861 User Verification <= 2.0.47 - Unauthenticated Arbitrary Account Lockout via IDOR

The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification...

CVE-2026-16058

The YayCurrency WordPress plugin before 3.3.5 contains an unauthenticated information disclosure vulnerability in its multi-vendor integration handlers (specifically the Dokan integration). The root cause is the absence of capability or ownership checks on these handlers, which are reachable with...

EUVD-2026-62269

The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable by unauthenticated users, allowing anyone to read the store's order totals and its vendors' earnings, balance ledgers, and...

CVE-2026-14861

The User Verification by PickPlugins WordPress plugin (through 2.0.47) is vulnerable to an unauthenticated IDOR: the resend-verification-email endpoint fails to authorize the requesting user or bind the protecting token to that user, allowing attackers to reset email-verification status and lock ...

CVE-2026-14826 Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including...

CVE-2026-14826

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 lacks per-object ownership checks on REST routes, allowing contributor-level users to read other users' quiz notification recipient addresses via IDOR. Exploitation details are not provided. Upgrade to QSM 11.2.4 to remediate.

CVE-2026-14825

Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 lacks per-object ownership checks on front-end text settings, allowing contributor+ users to modify quizzes owned by others via IDOR. CVSS 2.7 LOW; no exploitation observed. Upgrade to 11.2.4. https://wpscan.com/vulnerability/fb66cb33-e1...

CVE-2026-14825 Quiz And Survey Master < 11.2.4 - Contributor+ Arbitrary Quiz Text Settings Update via IDOR

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users...

CVE-2026-14196 WCFM Marketplace < 3.8.1 - Store Vendor+ Cross-Vendor Review Deletion and Status Update via IDOR

The WCFM Marketplace WordPress plugin before 3.8.1 does not verify that a marketplace vendor owns a review before allowing it to be unapproved or deleted, allowing any vendor to modify or permanently delete reviews belonging to other vendors' stores...

CVE-2026-14196

The WCFM Marketplace WordPress plugin before 3.8.1 contains an IDOR flaw: it fails to verify review ownership, so any authenticated store vendor can unapprove or permanently delete reviews belonging to other vendors' stores. Exploitation requires low privileges (PR:L), network access, and no user...

CVE-2026-14825 Quiz And Survey Master < 11.2.4 - Contributor+ Arbitrary Quiz Text Settings Update via IDOR

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users...

EUVD-2026-62258

The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including...

CVE-2026-13175

The Eventin WordPress plugin before 4.1.21 suffers from an IDOR flaw: schedule records are modified or deleted without ownership checks, allowing contributor-level users to alter or remove other users' entries. CVSS 6.5 (MEDIUM) rates this as network-exploitable with high privileges required. No ...

CVE-2026-13174 Eventin < 4.1.21 - Contributor+ Speaker Account Deletion via IDOR

The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts...

CVE-2026-13169

The Eventin WordPress plugin before 4.1.21 suffers from an IDOR flaw: contributor-level users can modify, delete, or reassign events created by others, including administrators, due to missing ownership verification. This grants unauthorized integrity and confidentiality control over event data. ...

EUVD-2026-62261

The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users...

CVE-2026-13169 Eventin < 4.1.21 - Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeover via IDOR

The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including...

CVE-2026-13174

The Eventin WordPress plugin before 4.1.21 has an IDOR flaw: contributor-level users can permanently delete other users' accounts. Update to 4.1.21 or later. No active exploitation reported. Patch via the Eventin plugin update page. Details: https://wpscan.com/vulnerability/849478d1-640f-49e0-8fa...

CVE-2026-13175 Eventin < 4.1.21 - Contributor+ Schedule Deletion and Modification via IDOR

The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users...

CVE-2026-13169 Eventin < 4.1.21 - Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeover via IDOR

The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including...