EUVD-2026-74698

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking...

CVE-2026-8615

CVE-2026-8615 affects the Reviso Exporter for WooCommerce WordPress plugin in versions up to and including 1.2.3 . The root cause is a missing capability check and nonce verification on the disconnect_callback() function, registered to the wp_ajax_wcefr-disconnect AJAX action. This function uncon...

EUVD-2026-74690

The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnectcallback function in versions up to, and including, 1.2.3. The function is registered to the...

CVE-2026-8615 ilGhera Reviso Exporter for WooCommerce <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function

The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnectcallback function in versions up to, and including, 1.2.3. The function is registered to the...

CVE-2026-8615 ilGhera Reviso Exporter for WooCommerce <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function

The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnectcallback function in versions up to, and including, 1.2.3. The function is registered to the...

EUVD-2026-74687

The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the 'wpfnlloadpayment' AJAX action for both authenticated and unauthenticated wpajaxnopriv users and the underlying addofferproducttocart...

CVE-2026-84908 WPFunnels <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via 'wpfnl_load_payment' AJAX Action

The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the 'wpfnlloadpayment' AJAX action for both authenticated and unauthenticated wpajaxnopriv users and the underlying addofferproducttocart...

CVE-2026-84908

The WPFunnels WordPress plugin (versions ≤ 3.12.13 ) is vulnerable to Missing Authorization in its wpfnl_load_payment AJAX action, which is registered for both authenticated and unauthenticated users. The underlying add_offer_product_to_cart() function performs no nonce verification, no capabilit...

CVE-2026-84908 WPFunnels <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via 'wpfnl_load_payment' AJAX Action

The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the 'wpfnlloadpayment' AJAX action for both authenticated and unauthenticated wpajaxnopriv users and the underlying addofferproducttocart...

CVE-2026-19946 Awesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter

The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpasdomrdenyuser function, which unlike its counterpart wpasdomractivateuser does not enforce currentusercan'editusers' or...

CVE-2026-19946

The Awesome Support plugin for WordPress (versions up to and including 6.3.9 ) contains a Missing Authorization flaw in the wpas_do_mr_deny_user() function. Unlike its counterpart wpas_do_mr_activate_user(), this function fails to enforce a current_user_can('edit_users') capability check, relying...

EUVD-2026-74686

The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpasdomrdenyuser function, which unlike its counterpart wpasdomractivateuser does not enforce currentusercan'editusers' or...

CVE-2026-11821 Eventin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

CVE-2026-11821 Eventin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

CVE-2026-75966

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episodecontributor....comment' Parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

DEBIAN-CVE-2026-57825

In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files...

Malicious code in gloggo (npm)

Source: amazon-inspector a333f8ded17af0754357d938933ee95e9ab1f857cc875948d49cb9b26992e75d gloggo impersonates the legitimate gulpjs 'glogg' logging library by copying its README, shields, and LICENSE text attributed to Blaine Bublitz, while package.json attributes authorship to 'Blockvora Team '...

CVE-2026-12956

The WP Event Solution Eventin plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the createitem handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's createitempermissionscheck function only verifies a wprest nonce which is...

EUVD-2026-74565

The WP Event Solution Eventin plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the createitem handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's createitempermissionscheck function only verifies a wprest nonce which is...

CVE-2026-12956

The WP Event Solution (Eventin) WordPress plugin (versions ≤ 4.1.22 ) is affected by a Missing Authorization vulnerability in the /wp-json/eventin/v2/orders REST endpoint. The create_item_permissions_check() function relies solely on a wp_rest nonce that is leaked to every visitor via the etn-pub...