WCFM Membership <= 2.10.0 - Broken Access Control

The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks true the AJAX actions: wcfm-memberships, wcfm-memberships-manage, and wcfm-memberships-settings. id: CVE-2022-4940 info:...

PublishPress Capabilities < 2.3.1 - Missing Authorization

The PublishPress Capabilities plugin for WordPress before 2.3.1 does not have proper authorization and CSRF checks when updating settings via the init hook, allowing unauthenticated attackers to update arbitrary blog options, such as setting the default role to administrator. id: CVE-2021-25032...

LottieFiles WordPress Plugin <= 3.0.0 - Missing Authorization

LottieFiles LottieFiles = 3.0.0 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers exploit missing authorization, exploit requires no special privileges. id: CVE-2025-68043 info: name: LottieFiles WordPress Plugin =...

WordPress RSVP and Event Management <2.7.8 - Missing Authorization

WordPress RSVP and Event Management plugin before 2.7.8 is susceptible to missing authorization. The plugin does not have any authorization checks when exporting its entries, and the export function is hooked to the init action. An attacker can potentially retrieve sensitive information such as...

WPZOOM Social Icons Widget <= 4.2.15 - Missing Authorization

WPZOOM Social Icons Widget & Block versions up to 4.2.15 contain a missing authorization vulnerability caused by insufficient access control in the widget and block, letting attackers perform unauthorized actions, exploit requires no special conditions. id: CVE-2024-30464 info: name: WPZOOM Socia...

ElementsKit Lite <3.7.9 - Unauthenticated Mailchimp Proxy

The ElementsKit Elementor Addons Lite elementskit-lite plugin for WordPress before 3.7.9 registers the REST route /wp-json/elementskit/v1/widget/mailchimp/subscribe with no authentication or capability check CWE-306. The handler accepts client-supplied Mailchimp API credentials and a list paramet...

Canto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload

The Canto plugin for WordPress is vulnerable to missing authorization in the copy-media.php upload flow. The file is directly accessible and accepts attacker-controlled parameters for the upload destination, allowing unauthenticated users to upload arbitrary files constrained to WordPress-allowed...

CVE-2026-12956

The WP Event Solution Eventin plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the createitem handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's createitempermissionscheck function only verifies a wprest nonce which is...

CVE-2026-12956 Eventin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameter

The WP Event Solution Eventin plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the createitem handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's createitempermissionscheck function only verifies a wprest nonce which is...

EUVD-2026-74565

The WP Event Solution Eventin plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the createitem handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's createitempermissionscheck function only verifies a wprest nonce which is...

CVE-2026-87534

A flaw was found in WebView in Google Chrome. This missing authorization vulnerability allows a remote attacker, by leveraging social engineering techniques, to bypass system access restrictions. This can be achieved through specially crafted network traffic...

CVE-2026-87434

A flaw was found in Chromium, affecting Google Chrome. A remote attacker, having compromised the renderer process, could exploit missing authorization in Cross-Origin Resource Sharing CORS to bypass the web origin policy. This could be achieved by enticing a user to visit a crafted HTML page,...

CVE-2026-87429

A flaw was found in the ServiceWorker component of Chromium. A remote attacker, after compromising the renderer process, could exploit a missing authorization vulnerability by crafting a malicious HTML page. This could allow the attacker to bypass system access restrictions...

CVE-2026-87622

A flaw was found in chromium-browser. Missing authorization in the Federated Credential Management FedCM API allowed a remote attacker to bypass the web origin policy. This bypass could be achieved by enticing a user to visit a crafted HTML page, potentially leading to unauthorized access to...

CVE-2026-87543

A flaw was found in Google Chrome. A remote attacker who has compromised the renderer process can exploit a missing authorization vulnerability by crafting a malicious HTML page. This allows them to bypass site isolation, which is a security mechanism designed to protect user data and prevent...

CVE-2026-87443

A missing authorization flaw was found in the Actor component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=502768228...

CVE-2026-87475

A missing authorization flaw was found in the Omnibox component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=507225626...

CVE-2026-87493

A flaw was found in chromium-browser. Missing authorization in the FileSystem component allows a remote attacker to bypass system access restrictions. This can be achieved by leveraging social engineering techniques through a specially crafted HTML page...

CVE-2026-87552

A flaw was found in Google Chrome on Android. A local attacker could exploit missing authorization in the TrustedWebActivities feature via a co-installed application. This could allow the attacker to obtain sensitive information...

CVE-2026-87557

A flaw was found in chromium-browser. A remote attacker, who has already compromised the renderer process, could exploit a missing authorization vulnerability in LocalNetworkAccess. This could allow the attacker to bypass system access restrictions by using a specially crafted HTML page...