CVE-2026-16046

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a run participant to modify status, checklists, retrospective content, ownership, and participants on completed runs via REST and GraphQL API...

CVE-2026-12998

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.55.0.2 via the 'draft' parameter due to missing validation on a user controlled key. This makes it possible for...

CVE-2026-12998

The CVE concerns the Forminator Forms plugin for WordPress (up to version 1.55.0.2) and describes an Insecure Direct Object Reference via the draft parameter, enabling unauthenticated attackers to enumerate sequential form-draft entry IDs and read other users’ saved draft data (names, emails, pho...

CVE-2026-12998 Forminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.55.0.2 via the 'draft' parameter due to missing validation on a user controlled key. This makes it possible for...

CVE-2026-12998

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.55.0.2 via the 'draft' parameter due to missing validation on a user controlled key. This makes it possible for...

CVE-2026-12905

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment method of the Mobile Staff Cabinet API resource=appointment, action=booklymobilestaffcabinet in...

CVE-2025-10005 Password Protect WordPress Lite <= 1.9.20 - Insecure Direct Object Reference to Authenticated (Contributor+) Password Protected Post Password Update

The PPWP – Password Protect WordPress | 1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.20 via the ppwfreesetpassword AJAX action due to missing validation on a user controlled key. This makes it...

CVE-2025-10005

The CVE-2025-10005 entry describes a vulnerability in the PPWP – Password Protect WordPress plugin (WordPress). An Insecure Direct Object Reference exists in all versions up to and including 1.9.20 via the ppw_free_set_password AJAX action, caused by missing validation on a user-controlled key. T...

CVE-2025-10005 Password Protect WordPress Lite <= 1.9.20 - Insecure Direct Object Reference to Authenticated (Contributor+) Password Protected Post Password Update

The PPWP – Password Protect WordPress | 1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.20 via the ppwfreesetpassword AJAX action due to missing validation on a user controlled key. This makes it...

EUVD-2025-210731

The PPWP – Password Protect WordPress | 1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.20 via the ppwfreesetpassword AJAX action due to missing validation on a user controlled key. This makes it...

CVE-2025-10005

The PPWP – Password Protect WordPress | 1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.20 via the ppwfreesetpassword AJAX action due to missing validation on a user controlled key. This makes it...

CVE-2026-13358 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.10 via the ssapastappointments due to missing validation on a user controlled key. This makes it...

CVE-2026-13358 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.10 via the ssapastappointments due to missing validation on a user controlled key. This makes it...

EUVD-2026-59859

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.10 via the ssapastappointments due to missing validation on a user controlled key. This makes it...

CVE-2026-13358

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.10 via the ssapastappointments due to missing validation on a user controlled key. This makes it...

CVE-2026-12905 Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment method of the Mobile Staff Cabinet API resource=appointment, action=booklymobilestaffcabinet in...

EUVD-2026-59850

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment method of the Mobile Staff Cabinet API resource=appointment, action=booklymobilestaffcabinet in...

CVE-2026-12905

The CVE-2026-12905 entry concerns the Bookly WordPress plugin (up to version 27.7). Affected component is the Mobile Staff Cabinet API, specifically appointment() in Handler1_0.php. The vulnerability is an Insecure Direct Object Reference: attacker-supplied params[id] load appointments without ve...

CVE-2026-12905: Authorization Bypass Through User-Controlled Key

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment method of the Mobile Staff Cabinet API resource=appointment, action=booklymobilestaffcabinet in...

CVE-2026-13358: Authorization Bypass Through User-Controlled Key

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.10 via the ssapastappointments due to missing validation on a user controlled key. This makes it...