90 matches found
CVE-2026-18037 Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication
The Create WordPress plugin before 2.5.4 does not perform an authorization check before rendering content over one of its public REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to mak...
CVE-2026-18037
CVE-2026-18037 affects the Create WordPress plugin prior to 2.5.4. The vulnerability arises because a public REST API route does not perform an authorization check, and the route’s side effect publishes the requested content. This allows unauthenticated attackers to read unpublished content and t...
CVE-2026-24552
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in John-Michael L'Allier Create allows Blind SQL Injection. This issue affects Create: from n/a through 2.5.3...
EUVD-2026-48101
Unauthenticated Sensitive Data Exposure in Create by Mediavine = 2.5.3 versions...
CVE-2026-65490
Unauthenticated Sensitive Data Exposure in Create by Mediavine = 2.5.3 versions...
CVE-2026-65490
The CVE-2026-65490 entry concerns the WordPress plugin Create by Mediavine (versions <= 2.5.3), with unauthenticated sensitive data exposure identified. The connected records confirm the affected software (Create by Mediavine plugin) and the version bound (
CVE-2026-25424
CVE-2026-25424 concerns the WordPress Mediavine Control Panel plugin, affected in versions
EUVD-2026-48148
Contributor Broken Access Control in Mediavine Control Panel = 2.10.10 versions...
CVE-2026-24552 WordPress Create plugin <= 2.5.3 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in John-Michael L'Allier Create allows Blind SQL Injection. This issue affects Create: from n/a through 2.5.3...
CVE-2026-24552 WordPress Create plugin <= 2.5.3 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in John-Michael L'Allier Create allows Blind SQL Injection. This issue affects Create: from n/a through 2.5.3...
CVE-2026-24552
CVE-2026-24552 concerns the WordPress plugin “Create by Mediavine” (versions
EUVD-2026-48144
Contributor SQL Injection in Create by Mediavine = 2.5.3 versions...
WordPress Create by Mediavine plugin <= 2.5.5 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Que Thanh Tuan in WordPress Plugin Create by Mediavine versions = 2.5.5...
CVE-2025-62893
Authorization Bypass Through User-Controlled Key vulnerability in mediavine Create by Mediavine mediavine-create allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Create by Mediavine: from n/a through = 1.9.14...
EUVD-2025-36045
Authorization Bypass Through User-Controlled Key vulnerability in mediavine Create by Mediavine mediavine-create allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Create by Mediavine: from n/a through = 1.9.14...
CVE-2025-62893
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2025-62893
...
CVE-2025-62893
CVE-2025-62893 (mode C): The connected Red Hat and EUVD/EUV sources describe an Authorization Bypass Through a User-Controlled Key in the Mediavine Create by Mediavine mediavine-create plugin. The affected version range is from n/a through 1.9.14. The root cause is a misconfigured access control ...
PT-2025-43772
Authorization Bypass Through User-Controlled Key vulnerability in mediavine Create by Mediavine mediavine-create allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Create by Mediavine: from n/a through = 1.9.14...