EUVD-2026-76855

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php that allows unauthenticated attackers to access scheduler email jobs by providing a site-wide daily token. Attackers can enumerate scheduler...

CVE-2026-90537

CVE-2026-90537 affects WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) in the file plugin/Scheduler/sendEmail.json.php . The root cause is a missing authorization check : an unauthenticated attacker can access scheduler email jobs by supplying any valid site-wide daily token...

CVE-2026-90537 WWBN AVideo Scheduler sendEmail Missing Authorization via Token

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php that allows unauthenticated attackers to access scheduler email jobs by providing a site-wide daily token. Attackers can enumerate scheduler...

CVE-2026-90536

WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) contains a missing authorization flaw in the adsInfo API endpoint . Unauthenticated attackers can call the endpoint with a videos_id parameter to retrieve password-protected video owner identifiers (user IDs) and personalized a...

EUVD-2026-76854

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to authorize access to the adsInfo API endpoint, allowing unauthenticated attackers to retrieve password-protected video owner identifiers. Attackers can call the adsInfo API with a videosid parameter to obtain the owner's...

CVE-2026-27344

Control de acceso roto en Inseri Core plugin de WordPress Plugin: Inseri Core Componente afectado: /includes/restapi.php Tipo de vulnerabilidad: Control de acceso roto Falta de autorización Estado: Reportada en agosto de 2026– cerrada como Duplicada. Resumen Mientras realizaba pruebas este verano...

CVE-2021-46704-POC

CVE-2021-46704-POC CVE-2021-46704 GenieACS 命令注入 POC 影响 genieacs 包，版本 =1.2.0 且 1.2.8 如何修复？ 将 genieacs 升级到 1.2.8 或更高版本。 受影响版本的此包存在命令注入漏洞，通过 ping 主机参数（lib/ui/api.ts 和 lib/ping.ts）引发，原因是输入验证不足且缺少授权检查。...

CVE-2026-11355 DT LMS <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via Multiple AJAX Actions

The DT LMS – elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX handlers including dtlmssavepocsettings, dtlmssaveskinsettings, and dtlmssaveoptionssettings in versions up to, and including, 1.1. Thes...

CVE-2026-11355

The DT LMS – elearning WordPress plugin (versions ≤ 1.1) is vulnerable to unauthorized modification of plugin settings due to missing capability checks on multiple AJAX handlers (dtlms_save_poc_settings, dtlms_save_skin_settings, dtlms_save_options_settings). These handlers are registered on the ...

CVE-2026-87891

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates...

CVE-2026-87894

The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email...

CVE-2026-87888

The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin befor...

CVE-2026-81742

The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in...

EUVD-2026-76804

The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email...

EUVD-2026-76801

The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin befor...

EUVD-2026-76802

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates...

CVE-2026-87888

The YayPricing WordPress plugin before 3.5.7 is vulnerable to stored XSS caused by a missing authorization check on the save_page_data REST route that saves pricing rules. Users with the subscriber role or above can store malicious JavaScript that executes in the browser of an administrator who o...

EUVD-2026-76786

The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in...

CVE-2026-77752

Temporary Login Without Password is a WordPress plugin for managing temporary user access. Versions 1.5 through 1.9.8 fail to verify that a user requesting a temporary login already holds network super admin rights before granting those rights to the new or existing account. In a multisite networ...

CVE-2024-34444-Exploit-Poc

CVE-2024-34444 - Slider Revolution 未授权扫描器 针对影响 Slider Revolution WordPress 插件（版本 6.7.0）的 CVE-2024-34444 的专业批量扫描器 Banner 🎯 描述 CVE-2024-34444 是 Slider Revolution WordPress 插件（版本 6.7.0）中的一个缺失授权 漏洞。该扫描器通过 REST API 端点 /wp-json/revslider/v1/slider/save 自动检测并利用易受攻击的安装。 技术细节 CVE ID : CVE-2024-34444 CVSS ...