CVE-2026-49226

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a low-privileged Author to access posts owned by another Author. The admin/controller/content/posts.php controller permits filteradminid to...

EUVD-2026-61024

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a low-privileged Author to access posts owned by another Author. The admin/controller/content/posts.php controller permits filteradminid to...

CVE-2026-49226

Vvveb's admin/controller/content/posts.php lets low-privileged Authors override admin_id filters and supply caller-controlled post_id values for duplicate/delete actions, while admin/sql/sqlite/post.sql inconsistently enforces post.admin_id. This enables cross-author post viewing, duplication, de...

CVE-2026-49226 Vvveb post authorization bypass allows Authors to view, duplicate, or delete other Authors' posts

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a low-privileged Author to access posts owned by another Author. The admin/controller/content/posts.php controller permits filteradminid to...

CVE-2026-49226 Vvveb post authorization bypass allows Authors to view, duplicate, or delete other Authors' posts

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a low-privileged Author to access posts owned by another Author. The admin/controller/content/posts.php controller permits filteradminid to...

CVE-2026-49227 Vvveb comment authorization bypass allows Authors to read, approve, edit, or delete comments under other Authors' posts

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend comment operations allow a low-privileged Author to manage comments under another Author's posts. The admin/controller/content/comment.php and...

CVE-2026-32463

Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...

CVE-2026-32463 WordPress Sync Post With Other Site plugin <= 1.9.3 - Arbitrary File Upload vulnerability

Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...

CVE-2026-32463 WordPress Sync Post With Other Site plugin <= 1.9.3 - Arbitrary File Upload vulnerability

Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...

CVE-2026-32463

Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...

EUVD-2026-60899

Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...

CVE-2026-32463

CVE-2026-32463 is an arbitrary file upload vulnerability in the WordPress plugin Sync Post With Other Site , affecting versions 1.9.3 and below . The flaw allows a user with Contributor privileges (low privilege) to upload arbitrary files, which can lead to full site compromise. The CVSS 3.1 scor...

CVE-2026-75833

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack before version 1.0.14 contains an open redirect weakness in SsoController::sanitizeReturnTo. The function rejects a literal '//' prefix but does not account for browsers normalizing backslashes to slashes in...

CVE-2026-75833

The Grav API plugin (bundled with Grav 2.0's admin-next/API stack) before version 1.0.14 has an open redirect in SsoController::sanitizeReturnTo(): a backslash-prefix like /\evil.com bypasses the // guard and is normalized by browsers to //evil.com, enabling post-OAuth-login phishing. Exploitatio...

WordPress Toocheke Companion plugin <= 2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'series_bg_color' Post Meta vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'seriesbgcolor' Post Meta vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Toocheke Companion versions = 2.10...

WordPress Smash Balloon Social Post Feed plugin <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'id' Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Smash Balloon Social Post Feed versions = 4.9.0...

tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass

A flaw was found in Apache Tomcat. This incorrect authorization vulnerability occurs within the FORM authentication process, allowing a user to bypass security constraints. This bypass enables unauthorized access to resources via a GET request, even when those resources are intended to be...

WordPress Password Protect WordPress Lite plugin <= 1.9.20 - Insecure Direct Object Reference to Authenticated (Contributor+) Password Protected Post Password Update vulnerability

Insecure Direct Object Reference to Authenticated Contributor+ Password Protected Post Password Update vulnerability discovered by Dmitrii Ignatyev - CleanTalk Inc in WordPress Plugin PPWP versions = 1.9.20...

WordPress Fullscreen Galleria plugin <= 1.6.12 - Authenticated (Contributor+) SQL Injection via 'href' Attribute in Post Content vulnerability

Authenticated Contributor+ SQL Injection via 'href' Attribute in Post Content vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Fullscreen Galleria versions = 1.6.12...

WordPress ECS plugin < 4.3.8 - Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater Handlers vulnerability

Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater Handlers vulnerability discovered by Seongwon LEE in WordPress Plugin ECS – Ele Custom Skin for Elementor versions 4.3.8...