256385 matches found
WordPress Pixel Manager for WooCommerce plugin <= 1.69.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Pixel Manager for WooCommerce versions = 1.69.0...
WordPress Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Mor Golan in WordPress Plugin Blacklist Manager WooCommerce Anti-Fraud, Blacklist & Checkout Verification versions = 2.3.1...
Important: Red Hat Security Advisory: yggdrasil-worker-package-manager security update
An update for yggdrasil-worker-package-manager is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...
CVE-2026-93662
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street...
CVE-2026-93661
The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event...
CVE-2026-93662 Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street...
CVE-2026-93662
The Events Manager WordPress plugin, in versions prior to 7.4.5 , is vulnerable to an unauthorized data disclosure flaw. The application fails to enforce proper scope for logged-in event and location searches when a caller provides a custom owner value . This allows a low-privileged user to read ...
CVE-2026-93661
The Events Manager WordPress plugin (versions prior to 7.4.5 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to prevent a ticket-update request from replacing the original ticket identifiers used during authorization. This allows a user with permission to mana...
CVE-2026-93661 Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR
The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event...
CVE-2026-93662 Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street...
WordPress Events Manager plugin < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite vulnerability
Contributor+ Arbitrary Ticket Overwrite vulnerability discovered by Hasyros in WordPress Plugin Events Manager versions 7.4.5...
WordPress Events Manager plugin 7.4.1-7.4.4 - Subscriber+ Unpublished Event and Location Disclosure vulnerability
Subscriber+ Unpublished Event and Location Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Events Manager versions 7.4.1-7.4.4...
EUVD-2026-85809
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street...
EUVD-2026-85808
The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event...
CVE-2026-93661 Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR
The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event...
PT-2026-97720
Name of the Vulnerable Software and Affected Versions Events Manager versions prior to 7.4.5 Description An issue exists in the Events Manager WordPress plugin where the scope of logged-in event and location searches is not enforced when a user provides a custom owner value. This allows a...
PT-2026-97726
Name of the Vulnerable Software and Affected Versions Kubernetes affected versions not specified Description A confused deputy attack in the kube-controller-manager allows a user with write permissions for StatefulSet and ControllerRevision objects within their own namespace to potentially create...
WSO2 Multiple Products Path Traversal Vulnerability
WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution...
PT-2026-97719
Name of the Vulnerable Software and Affected Versions Events Manager versions prior to 7.4.5 Description An Insecure Direct Object Reference IDOR exists where the plugin fails to prevent a ticket-update request from replacing the identifiers of the ticket it was authorized against. This allows a...
CVE-2026-93662: Exposure of Sensitive Information to an Unauthorized Actor
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street...