CVE-2026-6286

Amelia – Booking for Appointments and Events Calendar (WordPress plugin, versions ≤ 2.2) is vulnerable to unauthenticated stored XSS via customer name fields. The AddBookingCommand explicitly skips nonce verification (Command.php line 186), allowing unauthenticated users to submit booking data. A...

CVE-2026-8732

CVE-2026-8732 — WP Maps Pro ≤ 6.1.0 ♡ Неаутентифицированное повышение привилегий через создание учётной записи администратора ♡ === shadow ♡ & friska === 📋 Информация об уязвимости Поле| Детали ---|--- CVE ID| CVE-2026-8732 CVSS Score| 9.8 Critical CVSS Vector|...

CVE-2026-13414

The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain and exposed to anonymous visitors on others, allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a...

EUVD-2026-66867

The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain and exposed to anonymous visitors on others, allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a...

CVE-2026-40776

CVE-2026-40776 Eventin wp-event-solution Fehlerhafte Zugriffskontrolle Nicht authentifizierte Offenlegung personenbezogener Daten PII und Bestellungsfälschung im Eventin WordPress-Plugin 10.000+ aktive Installationen. Ein öffentlicher REST-Endpunkt gibt jedem Besucher ein wprest-Nonce aus, und dr...

CVE-2024-8682

CVE-2024-8682 - JNews अनधिकृत पंजीकरण PoC JNews = 11.6.6 में एक कमजोरी है जो ?ajax-request=jnews एंडपॉइंट के माध्यम से अनधिकृत उपयोगकर्ता पंजीकरण की अनुमति देती है, भले ही WordPress पंजीकरण अक्षम हो। यह पहले jnewsrefreshnonce क्रिया के माध्यम से एक मान्य jnewsnonce प्राप्त करके काम करता है, फिर...

CVE-2026-13404

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check relying only on a publicly-scrapeable nonce before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that...

CVE-2026-13404

CVE-2026-13404 affects the Royal Addons for Elementor WordPress plugin in versions prior to 1.7.1066 . The vulnerable function wpr_likes_init does not perform any capability or ownership check, relying solely on a publicly-scrapeable nonce before writing like-count and visitor-tracking post meta ...

CVE-2026-75930

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

EUVD-2026-65202

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing...

CVE-2025-6934

CVE-2025-6934 escalonamento de privilégio não autenticado no Opal Estate Pro Descrição CVE-2025-6934 é uma vulnerabilidade crítica no plugin WordPress Opal Estate Pro ≤ v1.7.5. Este bug permite que um atacante não autenticado crie uma nova conta de administrador enviando uma requisição...

CVE-2026-14853

The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...

EUVD-2026-64636

The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...

CVE-2026-14853 WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Product Creation via Missing Authorization

The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...

CVE-2026-14853

WooCommerce Bookings (WordPress plugin) versions before 3.9.0 contain an authorization flaw: one of its AJAX actions lacks a capability check , and the associated nonce check can be bypassed by simply omitting the token. This allows any authenticated user with Subscriber-level access or above to ...

node-opcua missing nonce verification in UserNameIdentityToken authentication

Summary A missing nonce verification in the UserNameIdentityToken authentication handler allows an unauthenticated remote attacker to forge a password token that extracts as an empty string, and to replay captured authentication tokens across sessions. Affected versions: = 2.165.0 Tested version:...

CVE-2026-73136 Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay

Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfer settled by an unrelated payer. MPP.Methods.Tempo normally binds a settled TIP-20 TransferWithMemo to the specific challenge under verification through an...

EUVD-2026-59926

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-15384

The Manual Image Crop WordPress plugin before 1.15 contains an IDOR (Insecure Direct Object Reference) vulnerability in its authenticated AJAX crop action. The endpoint performs no capability check or nonce verification, allowing any subscriber-level user to supply an arbitrary attachment ID and ...

CVE-2026-17581

The WCPOS – Point of Sale POS plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the 'thermal' Template Engine in all versions up to, and including, 1.9.14 due to the ReceiptRendererFactory dispatching templates with the 'thermal' engine to the LegacyPhpRenderer inste...