Video Conferencing with Zoom API < 4.6.6 - Unauthenticated SDK Signature Generation

Zoom WordPress plugin 4.6.6 contains a broken authentication caused by disabled nonce verification in an AJAX handler, letting unauthenticated attackers generate valid Zoom SDK signatures and retrieve the Zoom SDK key. id: CVE-2026-1368 info: name: Video Conferencing with Zoom API 4.6.6 -...

CVE-2023-6036

CVE-2023-6036 关于WordPress插件 Web3 – Crypto wallet Login & NFT token gating 3.0.0 - 认证绕过 的POC 该漏洞源于handleloginrequest函数和handleauthrequest函数中不正确的身份验证检查，导致认证绕过。 漏洞 笔者将登录流程分为3个步骤，实际上是通过Web3钱包登录时的3个不同POST请求。 1. handleloginrequest...

rcno-reviews

Reseñas de Libros Recencio Un plugin de WordPress para gestionar y mostrar reseñas de libros. Tipo de contenido personalizado, 7 taxonomías, 13 shortcodes, 7 widgets, 6 plantillas, 5 extensiones. Todos los datos almacenados en metadatos estándar de WordPress — sin tablas personalizadas...

EUVD-2026-76791

The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce before saving its meta field configuration, allowing an attacker to overwrite that configuration by tricking a logged-in administrator into visiting a crafted page...

CVE-2026-84024

The BEAR – Bulk Editor and Products Manager Professional for WooCommerce plugin (WordPress) before 1.2.2 fails to verify a CSRF nonce before saving its meta field configuration. An attacker can exploit this by tricking a logged-in administrator into visiting a crafted page, resulting in an unauth...

CVE-2026-84023

BEAR – Bulk Editor and Products Manager Professional for WooCommerce , a WordPress plugin, is affected in versions before 1.2.2 . The vulnerability stems from the plugin's failure to verify a CSRF nonce or check user capabilities before allowing updates to taxonomy terms. An attacker can modify a...

CVE-2026-65540

CVE-2026-65540 Popup for CF7 con Sweet Alert Hello document.getElementById'csrf'.submit;...

PT-2026-90575

I discovered a CSRF vulnerability in BEAR – Bulk Editor and Products Manager Professional for WooCommerce. CVE-2026-84024 — Meta Field Configuration Update via CSRF Affected versions: 1.2.2 Fixed in: 1.2.2 https://t.co/yjQ4aFRkjb BugBounty CyberSecurity CVE WordPress...

CVE-2026-11496

The Woo PDF Invoice Builder WordPress plugin (also distributed as "PDF Builder for WooCommerce") versions up to and including 2.0.8 are vulnerable to Insecure Direct Object Reference (IDOR) in the InspectOrder() AJAX handler (woocommerce-pdf-invoice-ajax.php:513), registered on wp_ajax_rednao_wcp...

WordPress Popup for CF7 with Sweet Alert 1.6.5 Cross Site Request Forgery

WordPress Popup for CF7 with Sweet Alert plugin versions 1.6.5 and below suffer from a cross site request forgery vulnerability. https://packetstorm.news/download/231122...

CVE-2026-14359

The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the adduserinwaitinglist function registered on the wpajaxyithwcwtladduser action being missing both a capability check and a nonce verificatio...

CVE-2026-14359 YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user

The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the adduserinwaitinglist function registered on the wpajaxyithwcwtladduser action being missing both a capability check and a nonce verificatio...

CVE-2026-8615

The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnectcallback function in versions up to, and including, 1.2.3. The function is registered to the...

CVE-2026-8615

CVE-2026-8615 affects the Reviso Exporter for WooCommerce WordPress plugin in versions up to and including 1.2.3 . The root cause is a missing capability check and nonce verification on the disconnect_callback() function, registered to the wp_ajax_wcefr-disconnect AJAX action. This function uncon...

PT-2026-86564

Name of the Vulnerable Software and Affected Versions Authen::SASL::Perl::DIGEST MD5 versions prior to 2.2100 Description An issue exists where the software accepts replayed authentication responses due to an unverified nonce in the server step function. While server start generates a fresh nonce...

CVE-2026-15550

The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulkactions' function. This makes it possible for authenticated attackers, with...

EUVD-2026-71992

The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulkactions' function. This makes it possible for authenticated attackers, with...

CVE-2026-15550 Ninja Forms - Save Progress <= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin_init Hook

The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulkactions' function. This makes it possible for authenticated attackers, with...

CVE-2026-81543

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability checks and nonce verification on multiple AJAX actions including wcapsaveconnectorsettings, wcapsendmanualemail,...

CVE-2026-14550

WPCafe WordPress plugin versions before 3.0.18 fail to perform an authorization check when creating a reservation via its REST API, validating only a publicly available nonce . This allows unauthenticated users to submit reservations with an arbitrary approval status, effectively bypassing the ad...