CVE-2026-18037

The CVE concerns the Create WordPress plugin (before 2.5.4). A public REST API route does not perform an authorization check, and renders content while also publishing it as a side effect, allowing unauthenticated disclosure of unpublished content and public publication of that content. Affected:...

CVE-2026-24552

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in John-Michael L'Allier Create allows Blind SQL Injection. This issue affects Create: from n/a through 2.5.3...

EUVD-2026-48101

Unauthenticated Sensitive Data Exposure in Create by Mediavine = 2.5.3 versions...

CVE-2026-24552

CVE-2026-24552 concerns the WordPress plugin “Create by Mediavine” (versions

EUVD-2026-48144

Contributor SQL Injection in Create by Mediavine = 2.5.3 versions...

CVE-2025-62893

Authorization Bypass Through User-Controlled Key vulnerability in mediavine Create by Mediavine mediavine-create allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Create by Mediavine: from n/a through = 1.9.14...

EUVD-2025-36045

Authorization Bypass Through User-Controlled Key vulnerability in mediavine Create by Mediavine mediavine-create allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Create by Mediavine: from n/a through = 1.9.14...

CVE-2025-62893

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2025-62893

...

CVE-2025-62893

...

CVE-2025-62893

CVE-2025-62893 (mode C): The connected Red Hat and EUVD/EUV sources describe an Authorization Bypass Through a User-Controlled Key in the Mediavine Create by Mediavine mediavine-create plugin. The affected version range is from n/a through 1.9.14. The root cause is a misconfigured access control ...

PT-2025-43772

Authorization Bypass Through User-Controlled Key vulnerability in mediavine Create by Mediavine mediavine-create allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Create by Mediavine: from n/a through = 1.9.14...

EUVD-2024-36708

Malicious code in bioql PyPI...

EUVD-2024-40156

Malicious code in bioql PyPI...

CVE-2024-5601

The Create by Mediavine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Schema Meta shortcode in all versions up to, and including, 1.9.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-37495

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mischiefmarmot Create by Mediavine mediavine-create.This issue affects Create by Mediavine: from n/a through = 1.9.7...

CVE-2024-43264

Insertion of Sensitive Information Into Sent Data vulnerability in mischiefmarmot Create by Mediavine mediavine-create.This issue affects Create by Mediavine: from n/a through = 1.9.8...

CVE-2024-43264

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Mediavine Create by Mediavine.This issue affects Create by Mediavine: from n/a through 1.9.8...

CVE-2024-43264

Insertion of Sensitive Information Into Sent Data vulnerability in mischiefmarmot Create by Mediavine mediavine-create.This issue affects Create by Mediavine: from n/a through = 1.9.8...

CVE-2024-43264

CVE-2024-43264 describes an Exposure of Sensitive Information to an Unauthorized Actor in the Mediavine Create WordPress plugin. Affected versions are Create by Mediavine up to 1.9.8 (inclusive). The connected sources confirm an unauthenticated exposure of sensitive data and identify the affected...