TRUfusion Enterprise <= 7.10.4.0 - Admin Contact Portal

TRUfusion Enterprise versions 7.10.4.0 and earlier contained a vulnerability that allowed unauthenticated access to the Internal Admin Contact Page, resulting in the disclosure of PII including partner and contact names. id: CVE-2025-27225 info: name: TRUfusion Enterprise = 7.10.4.0 - Admin Conta...

CVE-2026-103379 WATI Chat and Notification <= 1.1.8 - Unauthenticated Customer Order PII Disclosure via Leaked API Token

The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public endpoint that returns its stored API token, which an unauthenticated attacker can then present to a second public endpoint to obtain the order-received URL of any WooCommerce order...

CVE-2026-103379

The WATI Chat and Notification WordPress plugin, affecting versions through 1.1.8 , is vulnerable to an unauthenticated customer order PII disclosure . The flaw exists because a public endpoint fails to require a valid, non-empty secret when returning a stored API token . An unauthenticated attac...

exploit-CVE-2022-0482

Easy!Appointments PII disclosure Easy!Appointments --debug exploit.rb -h | --help Options: Root URL base path including HTTP scheme, port and root folder All events since default: 2015-01-11 All events until default: today --debug Display arguments -h, --help Show this screen Examples: exploit.rb...

CVE-2026-4106

CVE-2026-4106: WordPress HT Mega Unauthenticated PII Disclosure Exploit A robust, multi-threaded Proof of Concept PoC exploit for CVE-2026-4106 , targeting the HT Mega - Absolute Addons for Elementor plugin for WordPress versions 3.0.7. Vulnerability Overview The HT Mega plugin registers several...

CVE-2025-60357

CVE-2025-60357- NoSQLMongoDB Injection Vulnerability and Product description AhnLab EPP Management is a globally recognized next-generation advanced endpoint protection platform that integrates patch management, advanced malware detection, EDR, and XDR capabilities. NoSQLMongoDB Injection in was...

CVE-2026-52217-VTEX-Checkout-CrossTenant-IDOR

CVE-2026-52217 Cross-tenant and cross-user authorization flaw IDOR / BOLA in the VTEX Commerce Platform Checkout service. Field| Value ---|--- CVE ID| CVE-2026-52217 Vendor| VTEX Product| VTEX Commerce Platform, Checkout service chk Affected| Observed on chk v2.367.3 and reproduced on v2.374.3. T...

CVE-2026-13736

CVE-2026-13736: NewPath WildApricotPress Add-on – Member Directory = 1.0.0 — Unauthenticated Member PII Disclosure via REST API 📖 Advisory Overview CVE-2026-13736 is an unauthenticated Member Personally Identifiable Information PII disclosure vulnerability affecting the NewPath WildApricotPress...

CVE-2026-40776

CVE-2026-40776 Eventin wp-event-solution Broken Access Control Unauthenticated PII disclosure and order forgery in the Eventin WordPress plugin 10,000+ active installs. A public REST endpoint hands out a wprest nonce to any visitor, and three downstream permission callbacks accept that nonce as a...

CVE-2026-107630

The Email Templates Customizer and Designer for WordPress and WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible...

CVE-2026-107630 Email Templates Customizer and Designer for WordPress and WooCommerce <= 1.5.14 - Missing Authorization to Unauthenticated Order PII Disclosure via 'preview_order' Parameter

The Email Templates Customizer and Designer for WordPress and WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible...

EUVD-2026-114218

The Email Templates Customizer and Designer for WordPress and WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible...

CVE-2026-107630 Email Templates Customizer and Designer for WordPress and WooCommerce <= 1.5.14 - Missing Authorization to Unauthenticated Order PII Disclosure via 'preview_order' Parameter

The Email Templates Customizer and Designer for WordPress and WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible...

CVE-2026-107630

The Email Templates Customizer and Designer for WordPress and WooCommerce plugin (versions up to and including 1.5.14 ) is vulnerable to an authorization bypass due to insufficient verification of user permissions. This flaw allows unauthenticated attackers to enumerate WooCommerce order IDs usin...

WordPress Email Templates Customizer and Designer for WordPress and WooCommerce plugin <= 1.5.14 - Missing Authorization to Unauthenticated Order PII Disclosure vulnerability

Missing Authorization to Unauthenticated Order PII Disclosure vulnerability discovered by Kuba in WordPress Plugin Email Templates versions = 1.5.14...

CVE-2026-107630: saadiqbal Email Templates Customizer and Designer for WordPress and WooCommerce: The Email Templates Customizer and Designer for WordPress and WooCommerce plugin for WordPress is vulnerable to…

The Email Templates Customizer and Designer for WordPress and WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible...

PT-2026-133693

The Email Templates Customizer and Designer for WordPress and WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible...

CVE-2026-105996 Booking Package < 1.7.31 - Unauthenticated Booking PII Disclosure and Cancellation via Predictable Token

The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriving them instead from values it exposes publicly, so an unauthenticated attacker can reconstruct an arbitrary booking's token, disclose that booking's persona...

CVE-2026-105996 Booking Package < 1.7.31 - Unauthenticated Booking PII Disclosure and Cancellation via Predictable Token

The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriving them instead from values it exposes publicly, so an unauthenticated attacker can reconstruct an arbitrary booking's token, disclose that booking's persona...

WordPress Appointment Booking Plugin plugin < 5.7.5 - Agent+ Customer PII Disclosure vulnerability

Agent+ Customer PII Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin LatePoint versions 5.7.5...