47310 matches found
CVE-2026-4244
The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicatepost function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has editothersposts capability before...
EUVD-2026-64275
The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicatepost function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has editothersposts capability before...
CVE-2026-4244 Post Duplicator <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution
The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicatepost function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has editothersposts capability before...
CVE-2026-4244
The Post Duplicator plugin for WordPress (all versions up to and including 3.0.11 ) is vulnerable to unauthorized data modification due to a missing capability check in the duplicate_post() function. The function does not verify that the caller holds the edit_others_posts capability before accept...
CVE-2026-4244 Post Duplicator <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution
The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicatepost function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has editothersposts capability before...
CVE-2026-4245
The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.11. This is due to the duplicatepostpermissions permission callback only verifying the duplicateposts capability without checking whether the requesting user holds publishposts...
CVE-2026-13176
creationtimestamp| type| source ---|---|--- 2026-08-22 11:39:39+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3mto6uokzka2t...
EUVD-2026-64251
The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.11. This is due to the duplicatepostpermissions permission callback only verifying the duplicateposts capability without checking whether the requesting user holds publishposts...
WordPress Post Duplicator plugin <= 3.0.11 - Authorization Bypass to Authenticated (Contributor+) Post Duplication vulnerability
Authorization Bypass to Authenticated Contributor+ Post Duplication vulnerability discovered by Quốc Huy jtwings in WordPress Plugin Post Duplicator versions = 3.0.11...
CVE-2026-4245
The Post Duplicator WordPress plugin (all versions up to and including 3.0.11 ) is vulnerable to an authorization bypass in its REST API. The duplicate_post_permissions() callback only verifies the duplicate_posts capability without checking whether the user holds publish_posts or other status-ga...
CVE-2026-4245 Post Duplicator <= 3.0.11 - Authorization Bypass to Authenticated (Contributor+) Post Duplication
The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.11. This is due to the duplicatepostpermissions permission callback only verifying the duplicateposts capability without checking whether the requesting user holds publishposts...
CVE-2026-4245 Post Duplicator <= 3.0.11 - Authorization Bypass to Authenticated (Contributor+) Post Duplication
The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.11. This is due to the duplicatepostpermissions permission callback only verifying the duplicateposts capability without checking whether the requesting user holds publishposts...
CVE-2026-16260
The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in th...
CVE-2026-66001
creationtimestamp| type| source ---|---|--- 2026-08-22 06:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtnmhdlosm2m...
EUVD-2026-64216
The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in th...
CVE-2026-16260 Post Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title Field
The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in th...
CVE-2026-16260
The Post Grid, Slider & Carousel Ultimate WordPress plugin, in versions prior to 1.8.1 , is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The flaw exists because the plugin fails to properly sanitise and escape a custom post type setting before rendering it within an HTML attribute on...
WordPress Post Grid, Slider & Carousel Ultimate plugin < 1.8.1 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Post Grid, Slider & Carousel Ultimate versions 1.8.1...
CVE-2026-16260 Post Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title Field
The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in th...
SUSE CVE-2026-73197
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the /ipa/migration/migration.py endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increas...