WordPress Builderall for WordPress plugin <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Post Meta Modification vulnerability discovered by Wordfence PRISM in WordPress Plugin Builderall Builder for WordPress versions = 3.0.2...

CVE-2026-19944

The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneoreward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

EUVD-2026-74607

The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneoreward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-19944 WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta

The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneoreward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-19944

WP Crowdfunding for WordPress (versions up to and including 2.2.1 ) contains a second-order SQL injection in the wpneo_reward Post Meta field, caused by insufficient escaping and lack of prepared statements. An authenticated attacker with Shop Manager or higher privileges can inject a malicious p...

CVE-2026-19944 WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta

The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneoreward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

PT-2026-88792

The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneo reward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

Muse, Meta’s New Personal AI Agent, Needs You to Trust It

Designed to compete with OpenClaw and Instinct, the company says Muse can do everything from sell your car to book you a plane ticket...

Meta Failed to Catch Hundreds of AI Child Abuse Ads. Some Included Images of Real Kids

Images of real children—including a member of a European royal family—were used to create some of the 350 ads containing child sexual abuse. Lawmakers say they plan to investigate...

CVE-2026-86515: Uncontrolled Resource Consumption

A security vulnerability has been detected in vgmstream up to r2117. Impacted is the function addentry of the file src/meta/txtpparser.c of the component txtp. Such manipulation of the argument rangestart/rangeend leads to resource consumption. The attack may be performed from remote. The exploit...

EulerOS 2.0 SP12 : samba (EulerOS-SA-2026-3385)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the 'chec...

CVE-2026-6431 User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and...

CVE-2026-82584: Improper Neutralization of Escape, Meta, or Control Sequences

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt. mix igniter.install prints a confirmation panel an anti-typosquatting safeguard listing a package's hex...

WordPress Custom Contact Forms plugin <= 7.16 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Deletion and Post Meta Modification via Nested 'fields[].ID' / 'choices[].ID' Parameters vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Post Deletion and Post Meta Modification via Nested 'fields.ID' / 'choices.ID' Parameters vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Custom Contact Forms versions = 7.16...

EUVD-2026-71933

The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-lev...

CVE-2026-75018 Custom Contact Forms <= 7.16 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Deletion and Post Meta Modification via Nested 'fields[].ID' / 'choices[].ID' Parameters

The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-lev...

CVE-2026-75018 Custom Contact Forms <= 7.16 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Deletion and Post Meta Modification via Nested 'fields[].ID' / 'choices[].ID' Parameters

The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-lev...

CVE-2026-75018

Custom Contact Forms WordPress plugin (all versions up to and including 7.16 ) contains an authorization bypass due to missing capability checks on nested fields[].ID and choices[].ID parameters processed by _create_and_map_fields() and _create_and_map_choices(). While the top-level form ID is gu...

EUVD-2026-71881

The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the...

CVE-2026-84898 Eventin < 4.1.21 - Contributor+ LFI via Event Layout Meta

The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files...