10169 matches found
CVE-2026-15241
The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one of its AJAX actions, allowing unauthenticated users to abuse the site owner's stored third-party API key to send requests billed to the owner's account and, when an optional featu...
EUVD-2026-51934
The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one of its AJAX actions, allowing unauthenticated users to abuse the site owner's stored third-party API key to send requests billed to the owner's account and, when an optional featu...
CVE-2026-15241 ChatBot for eCommerce â WoowBot < 4.8.4 - Unauthenticated Gemini API Key Abuse via qcld_gemini_response
The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one of its AJAX actions, allowing unauthenticated users to abuse the site owner's stored third-party API key to send requests billed to the owner's account and, when an optional featu...
CVE-2026-15241
The AI ChatBot for WooCommerce (also known as WoowBot ) WordPress plugin, in versions before 4.8.4 , is vulnerable to unauthenticated Gemini API key abuse . The root cause is a lack of authorization and nonce checks on the qcld_gemini_response AJAX action. An unauthenticated attacker can exploit ...
PT-2026-67065
The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one of its AJAX actions, allowing unauthenticated users to abuse the site owner's stored third-party API key to send requests billed to the owner's account and, when an optional featu...
July 28, 2026âKB5101681 (OS Build 28000.2608) Preview
None None...
EUVD-2026-42628
Open WebUI: Upload metadata.knowledgeid bypasses the knowledge-base write-access check read-only users can add files to KB...
GHSA-7R7X-GJVR-448G Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)
Open WebUI upload metadata can add files to knowledge bases without write permission Summary Open WebUI's file upload background processing trusts the client-supplied metadata.knowledgeid value and inserts a knowledgefile association before validating that the uploading user has write access to t...
Incorrect Authorization
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Incorrect Authorization in the processuploadedfile process. An attacker can modify the file membership of a knowledge base without proper authorization by supplying a crafted metadata.knowledgeid value during...
Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)
Open WebUI upload metadata can add files to knowledge bases without write permission Summary Open WebUI's file upload background processing trusts the client-supplied metadata.knowledgeid value and inserts a knowledgefile association before validating that the uploading user has write access to t...
CVE-2026-65522
Contributor Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...
CVE-2026-65500
Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...
EUVD-2026-48124
Contributor Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...
CVE-2026-65522
The CVE-2026-65522 entry documents a Cross Site Scripting (XSS) vulnerability in the WordPress Manual theme (Documentation, Knowledge Base & Education WordPress Theme) up to version 7.5.4. The description specifies XSS in versions
EUVD-2026-48117
Unauthenticated Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...
CVE-2026-65511
Unauthenticated Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...
CVE-2026-65500
Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...
WordPress Manual - Documentation, Knowledge Base & Education WordPress Theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability
WordPress Manual - Documentation, Knowledge Base & Education WordPress Theme theme = 7.5.4 - Cross Site Scripting XSS vulnerability discovered by ed32.dll in WordPress Theme Manual - Documentation, Knowledge Base & Education WordPress Theme versions = 7.5.4...
CVE-2026-65522: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...
CVE-2026-65511: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...