CVE-2026-78138

CVE-2026-78138 is a missing capability check in the Finale Lite WordPress plugin (versions

CVE-2026-16569 ShopApper <= 0.4.62 - Subscriber+ Arbitrary Product Stock Update

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber...

EUVD-2026-66872

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber...

CVE-2026-16569

ShopApper (The Mobile App for WooCommerce) WordPress plugin versions through 0.4.62 (Patchstack reports affected up to 0.4.66) lack a capability check on a REST endpoint that handles stock-update operations. This allows any authenticated user with Subscriber role or higher to modify the stock qua...

CVE-2023-4800

ID do CVE: CVE-2023-4800 Tipo de Vulnerabilidade: Exposição de Dados Sensíveis Descrição: O plugin DoLogin Security para WordPress é vulnerável a acesso não autorizado de dados devido à falta de uma verificação de capacidade no widget do painel em versões até a 3.7 inclusive. Isso possibilita que...

CVE-2024-3553

CVE-2024-3553 Tutor LMS = 2.6.2 - Autorizzazione mancante per aggiornamento non autenticato di opzioni limitate Il plugin Tutor LMS – soluzione eLearning e corsi online per WordPress è vulnerabile a modifiche non autorizzate dei dati a causa di un controllo di capacità mancante sulla funzione...

CVE-2023-3124

CVE-2023-3124 CVE-2023-3124 Preuve de concept Ceci est un exploit de preuve de concept PoC pour CVE-2023-3124, une vulnérabilité dans le plugin Elementor Pro de WordPress. Description: Le plugin Elementor Pro pour WordPress est vulnérable à une modification non autorisée des données en raison d'u...

CVE-2024-7856

CVE-2024-7856 ★ CVE-2024-7856 PoC di eliminazione arbitraria di file ★ Descrizione CVE-2024-7856 : MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar = 5.7.0.1 – Mancanza di autorizzazione per l'eliminazione arbitraria di file da parte di utenti autenticati Subscriber+ Ricercatore ...

CVE-2026-77693

The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be deleted, allowing users with the Shop Manager role and above to delete arbitrary files on the server, which could lead to the si...

CVE-2026-77754

The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and settings...

EUVD-2026-66286

The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and settings...

CVE-2026-77754 Kirki < 6.0.14 - Unauthenticated User and Comment Author Email Disclosure via kirki_get_apis

The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and settings...

CVE-2026-77754

The Kirki WordPress plugin prior to version 6.0.14 is missing a capability check on some endpoints of the kirki_get_apis public AJAX action. This allows unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and site setti...

EUVD-2026-66283

The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be deleted, allowing users with the Shop Manager role and above to delete arbitrary files on the server, which could lead to the si...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098887)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098887 advisory. In the Linux kernel, the following vulnerability has been resolved: net: ipgre: require CAPNETADMIN in the device netns for changelink A tunnel changelink operates o...

CVE-2022-1329

CVE-2022-1329 Das Elementor Website Builder Plugin für WordPress ist anfällig für die unbefugte Ausführung mehrerer AJAX-Aktionen aufgrund einer fehlenden Berechtigungsprüfung in der Datei /core/app/modules/onboarding/module.php, die es Angreifern ermöglicht, Websitedaten zu ändern und bösartige...

CVE-2023-6700

CVE-2023-6700 Cookie Information | Free GDPR Consent Solution = 2.0.22 - Authentifiziert Subscriber+ Beliebige Optionen aktualisieren Beschreibung: Das Plugin Cookie Information | Free GDPR Consent Solution für WordPress ist anfällig für beliebige Option-Updates aufgrund einer fehlenden...

CVE-2026-78467

The Fluent Support Pro plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized acti...

EUVD-2026-65302

The Fluent Support Pro plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized acti...

CVE-2026-19892

The InfusedWoo Pro plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 5.1.17. This is due to a missing capability check in the ajaxiwarpreviewemail function, which uses isadmin as its only authorization check and allows...