WordPress Simple File List < 4.2.3 - Unauthenticated Remote Code Execution

WordPress Simple File List plugin before version 4.2.3 is vulnerable to unauthenticated remote code execution. The ee-upload-engine.php and ee-file-engine.php scripts register their WordPress nonce checks via addaction'pluginsloaded', ... after including wp-load.php, making the security checks de...

WordPress Reset Database plugin <= 1.1.3 - Authenticated (Subscriber+) Privilege Escalation to Missing Capability and Nonce Check in process_reset() vulnerability

Authenticated Subscriber+ Privilege Escalation to Missing Capability and Nonce Check in processreset vulnerability discovered by Robert Huzo HuzoSecurity in WordPress Plugin Reset Database versions = 1.1.3...

CVE-2026-119303

The NotificationX WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its REST routes, allowing unauthenticated users to update a NotificationX WordPress plugin before 3.3.7 option and to repeatedly trigger emails sent through the site's own mail server...

EUVD-2026-123181

The NotificationX WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its REST routes, allowing unauthenticated users to update a NotificationX WordPress plugin before 3.3.7 option and to repeatedly trigger emails sent through the site's own mail server...

CVE-2026-117523 Dynific Addons for Elementor < 1.3.1 - Subscriber+ Module Settings Update via aep_module AJAX Action

The Dynific Addons for Elementor formerly Anywhere Elementor WordPress plugin before 1.3.1 does not perform a capability or nonce check on an AJAX action that saves its module configuration, allowing any authenticated user, including Subscribers, to enable or disable the Dynific Addons for...

EUVD-2026-123170

The Dynific Addons for Elementor formerly Anywhere Elementor WordPress plugin before 1.3.1 does not perform a capability or nonce check on an AJAX action that saves its module configuration, allowing any authenticated user, including Subscribers, to enable or disable the Dynific Addons for...

PT-2026-145006

The Dynific Addons for Elementor formerly Anywhere Elementor WordPress plugin before 1.3.1 does not perform a capability or nonce check on an AJAX action that saves its module configuration, allowing any authenticated user, including Subscribers, to enable or disable the Dynific Addons for...

CVE-2026-117523: Unknown Dynific Addons for Elementor (formerly Anywhere Elementor): The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a…

The Dynific Addons for Elementor formerly Anywhere Elementor WordPress plugin before 1.3.1 does not perform a capability or nonce check on an AJAX action that saves its module configuration, allowing any authenticated user, including Subscribers, to enable or disable the Dynific Addons for...

CVE-2026-119303: Unknown NotificationX: The NotificationX WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its REST…

The NotificationX WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its REST routes, allowing unauthenticated users to update a NotificationX WordPress plugin before 3.3.7 option and to repeatedly trigger emails sent through the site's own mail server...

CVE-2026-104307

The BackUpWordPress plugin before 3.15 does not perform a capability or nonce check on an AJAX action that cleans up its backup directory, allowing any authenticated user Subscriber and above to delete the BackUpWordPress plugin before 3.15's backup protection and working files, removing download...

CVE-2026-122085

The Event Tickets Manager for WooCommerce WordPress plugin (versions before 1.6.0 ) is vulnerable to an authorization bypass due to a lack of proper authorization and nonce checks on its ticket-transfer feature. Because this feature is accessible to unauthenticated users , an attacker can transfe...

CVE-2026-105993

The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings handlers, allowing unauthenticated attackers to modify the DT Directory Lite Addon WordPress plugin through 1.1's configuration and skin options...

PT-2026-136027

The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings handlers, allowing unauthenticated attackers to modify the DT Directory Lite Addon WordPress plugin through 1.1's configuration and skin options...

CVE-2026-116201

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple...

EUVD-2026-109459

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple...

CVE-2026-116201 Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple...

PT-2026-123042

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple...

CVE-2026-105973

The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user Subscriber and above to alter the field structure of any form on the site, persistently breaking its public rendering...

CVE-2026-87968

The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposes it to unauthenticated users, so any visito...

CVE-2026-87968

The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin, in versions before 5.3.2 , contains a vulnerability due to a missing nonce or capability check on an AJAX action. This flaw allows unauthenticated users to force a store re-regi...