47402 matches found
CVE-2026-16957
The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, allowing users with the Contributor role to read arbitrary post meta, including protected and private keys, of published posts they do not ow...
CVE-2026-16965
The Solace Extra WordPress plugin versions prior to 1.6.1 is vulnerable to an authorization bypass because it fails to perform capability or nonce checks in one of its AJAX actions. Specifically, the solace update sitebuilder status action allows any authenticated user, such as a subscriber , to ...
CVE-2026-16957 Slim SEO < 4.9.11 - Contributor+ Arbitrary Post Meta Disclosure
The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, allowing users with the Contributor role to read arbitrary post meta, including protected and private keys, of published posts they do not ow...
CVE-2026-16957
The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, allowing users with the Contributor role to read arbitrary post meta, including protected and private keys, of published posts they do not ow...
CVE-2026-16957
The Slim SEO WordPress plugin versions prior to 4.9.11 contains a vulnerability where a post-meta preview feature fails to properly restrict access. The component verifies only read access instead of ensuring the user is authorized to edit the specific post. This allows users with the Contributor...
CVE-2026-16965 Solace Extra < 1.6.1 - Subscriber+ Post Meta Update via solace_update_sitebuilder_status
The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber and, via CSRF, any logged-in user to update post meta on arbitrary posts and to deactivate the site's active templates...
CVE-2026-16957 Slim SEO < 4.9.11 - Contributor+ Arbitrary Post Meta Disclosure
The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, allowing users with the Contributor role to read arbitrary post meta, including protected and private keys, of published posts they do not ow...
CVE-2026-16965
The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber and, via CSRF, any logged-in user to update post meta on arbitrary posts and to deactivate the site's active templates...
EUVD-2026-54888
The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, allowing users with the Contributor role to read arbitrary post meta, including protected and private keys, of published posts they do not ow...
CVE-2026-16965 Solace Extra < 1.6.1 - Subscriber+ Post Meta Update via solace_update_sitebuilder_status
The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber and, via CSRF, any logged-in user to update post meta on arbitrary posts and to deactivate the site's active templates...
EUVD-2026-54889
The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber and, via CSRF, any logged-in user to update post meta on arbitrary posts and to deactivate the site's active templates...
CVE-2026-71986
creationtimestamp| type| source ---|---|--- 2026-08-09 02:00:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msmigy7i6q27 2026-08-09 13:30:13+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msnoyffrml2k...
CVE-2026-71993
creationtimestamp| type| source ---|---|--- 2026-08-09 00:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msmctj6fur2q 2026-08-09 01:30:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/117062960952906332 2026-08-09 01:30:30+00:00| seen|...
CVE-2026-13344
creationtimestamp| type| source ---|---|--- 2026-08-09 00:18:18+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msmcmiopux2g 2026-08-09 20:16:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msofoafgbf2z...
CVE-2026-71984
creationtimestamp| type| source ---|---|--- 2026-08-09 00:12:16+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msmcbpazap2o...
CVE-2026-16957: Authorization Bypass Through User-Controlled Key
The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, allowing users with the Contributor role to read arbitrary post meta, including protected and private keys, of published posts they do not ow...
PT-2026-69264
Name of the Vulnerable Software and Affected Versions Solace Extra versions prior to 1.6.1 Description The Solace Extra WordPress plugin fails to perform capability or nonce checks in an AJAX action. This allows any authenticated user, including those with subscriber privileges, to update post me...
PT-2026-69263
Name of the Vulnerable Software and Affected Versions Slim SEO versions prior to 4.9.11 Description A post-meta preview feature fails to restrict access to posts that the user is authorized to edit, verifying only read access. This allows users with the Contributor role to read arbitrary post met...
CVE-2026-16965: Cross-Site Request Forgery (CSRF)
The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber and, via CSRF, any logged-in user to update post meta on arbitrary posts and to deactivate the site's active templates...
CVE-2026-15257
creationtimestamp| type| source ---|---|--- 2026-08-08 20:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mslv7c4uaq2i 2026-08-09 16:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msnyb3cao62a...