PT-2026-95807

Name of the Vulnerable Software and Affected Versions Datalogics Ecommerce Delivery – Datalogics plugin for WordPress versions prior to 2.6.66 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated...

PT-2026-95789

Name of the Vulnerable Software and Affected Versions Redux Framework versions prior to 4.5.14 Description Stored Cross-Site Scripting occurs via Media field filter values. The issue stems from insufficient input sanitization of nested array values in the user meta save function and unsafe output...

CVE-2026-1984: Missing Authorization

The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepausegteditor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with...

PT-2026-95802

Name of the Vulnerable Software and Affected Versions Redux Framework versions prior to 4.5.14 Description Stored Cross-Site Scripting occurs via the spinner field due to insufficient input sanitization and output escaping. In the user meta save function, scalar values bypass sanitization logic...

WordPress Empik for Woocommerce plugin <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Product Meta Update vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Product Meta Update vulnerability discovered by Benedictus Jovan aillesiM in WordPress Plugin EmpikPlace for Woocommerce versions = 1.5.1...

WordPress Mapster WP Maps plugin <= 1.23.0 - Authenticated (Subscriber+) Arbitrary User Meta Write vulnerability

Authenticated Subscriber+ Arbitrary User Meta Write vulnerability discovered by Wordfence PRISM in WordPress Plugin Mapster WP Maps versions = 1.23.0...

Meta’s Copyright System Is Being Weaponized Against Albanian Protesters

After three months of daily anti-government protests—dubbed the Flamingo Revolution—the sudden mass suspension of Instagram accounts has led to fears of brigading against demonstrators...

CVE-2026-12954

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the myprofileupdate function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplie...

CVE-2026-12954

The Mapster WP Maps WordPress plugin (≤ 1.23.0) is vulnerable to Arbitrary User Meta Write via the my_profile_update() function. The function performs no nonce verification, capability check, or allowlist validation on the meta key supplied through the acf-photo-gallery-groups POST parameter befo...

EUVD-2026-82756

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the myprofileupdate function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplie...

CVE-2026-12954 Mapster WP Maps <= 1.23.0 - Authenticated (Subscriber+) Arbitrary User Meta Write via 'acf-photo-gallery-groups' Parameter

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the myprofileupdate function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplie...

CVE-2026-12954 Mapster WP Maps <= 1.23.0 - Authenticated (Subscriber+) Arbitrary User Meta Write via 'acf-photo-gallery-groups' Parameter

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the myprofileupdate function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplie...

CVE-2026-17586: Improper Neutralization of Input During Web Page Generation

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vkExUnitctaimgposition' Post Meta in all versions up to, and including, 9.118.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

PT-2026-95282

Name of the Vulnerable Software and Affected Versions Mapster WP Maps versions prior to 1.23.1 Description The plugin contains an Arbitrary User Meta Write flaw within the my profile update function. The issue occurs because the function fails to perform nonce verification, capability checks, and...

CVE-2026-12954: Improper Input Validation

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the myprofileupdate function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplie...

PT-2026-94169

Name of the Vulnerable Software and Affected Versions Comments Import & Export versions prior to 2.5.4 Description The plugin fails to restrict the comment export feature to users with comment moderation privileges and does not limit the export to content owned by the requesting user. This allows...

PT-2026-94392

Name of the Vulnerable Software and Affected Versions vgmstream affected versions not specified Description A remote attack can trigger a divide by zero error within the AWB parser component. The issue resides in the init vgmstream awb memory function located in the src/meta/awb.c file...

PT-2026-94342

Name of the Vulnerable Software and Affected Versions vgmstream versions prior to r2118 Description A security flaw exists that allows for remote resource consumption. The issue is located within the parse mus function of the src/meta/mus acm.c file. Recommendations Apply patch...

EulerOS 2.0 SP15 : samba (EulerOS-SA-2026-3797)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto- enrollment is enabled, Samba may retrieve a C...

CVE-2026-81923

In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord action validated the per-page CSRF token but never called canEditPageProperties for the target page, so a user who was granted access to the bulk SEO tool and...