PT-2026-67103

Name of the Vulnerable Software and Affected Versions Classified Listing WordPress plugin versions prior to 5.4.4 Description An AJAX action that returns post content fails to perform necessary capability or ownership checks. This allows users with contributor-level access or higher to read the...

CVE-2026-18089: Improper Verification of Cryptographic Signature

Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verifyxml when no trust anchor is configured. verifyxml in Net::SAML2::Role::VerifyXML runs "return if !$anchors && !$cacert;" as soon as the XML::Sig chec...

CVE-2026-56673

creationtimestamp| type| source ---|---|--- 2026-08-02 19:00:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms4o6frjq32t...

CVE-2026-56672

creationtimestamp| type| source ---|---|--- 2026-08-02 19:00:19+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms4o675pfx2b...

CVE-2026-67356

creationtimestamp| type| source ---|---|--- 2026-08-02 16:12:32+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms4es7oylx2x...

CVE-2026-68578

creationtimestamp| type| source ---|---|--- 2026-08-02 14:01:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms45i7bwtm2t 2026-08-03 02:39:01+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117029256627432016...

CVE-2026-15048

creationtimestamp| type| source ---|---|--- 2026-08-02 13:03:15+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms423xtogy2t...

CVE-2025-71402

creationtimestamp| type| source ---|---|--- 2026-08-02 11:39:50+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3ms3vkldfn52c...

CVE-2026-15248

creationtimestamp| type| source ---|---|--- 2026-08-02 11:09:17+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3tqjl2lz2x...

CVE-2026-15939

creationtimestamp| type| source ---|---|--- 2026-08-02 10:54:06+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3sytcj3t2z 2026-08-02 11:50:43+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3w6266kl2v 2026-08-02 11:51:03+00:00| seen|...

CVE-2026-16064

creationtimestamp| type| source ---|---|--- 2026-08-02 10:51:08+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3stj67we25 2026-08-02 11:55:45+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3wh2p2wf2z 2026-08-02 11:56:11+00:00| seen|...

CVE-2026-16273

The Narrative Publisher WordPress plugin through 1.0.7 does not restrict write access to a REST-exposed post meta field or escape it when rendering, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any higher-privileged user who views the...

CVE-2026-14864

The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its shortcodes, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of higher-privileged users such as...

CVE-2026-13389 WebToffee Cookie Consent < 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation via Unprotected REST Routes

The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST API routes, allowing unauthenticated attackers to export and delete stored visitor consent records, create posts, and modify the webtoffee-cookie-consent WordPress plugin before...

CVE-2026-13389 WebToffee Cookie Consent < 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation via Unprotected REST Routes

The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST API routes, allowing unauthenticated attackers to export and delete stored visitor consent records, create posts, and modify the webtoffee-cookie-consent WordPress plugin before...

CVE-2026-16064 Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arbitrary Post Modification via mpwem_quick_edit_event

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability, allowing users with the Contributor role and above to modify the title and publication status o...

CVE-2026-16064

The Event Booking Manager for WooCommerce WordPress plugin (versions before 5.3.7 ) contains an authorization bypass vulnerability. The application fails to properly verify authorization on the specific object being modified during the quick-editing of events, as it only checks for a global capab...

WordPress Event Booking Manager for WooCommerce plugin < 5.3.7 - Contributor+ Arbitrary Post Modification vulnerability

Contributor+ Arbitrary Post Modification vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin WpEvently versions 5.3.7...

EUVD-2026-51949

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not sanitise or escape event timeline content submitted by users with post-editing access before storing it and rendering it on the public event page, allowing users with the Author role and above to inject arbitrary...

CVE-2026-16063

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not sanitise or escape event timeline content submitted by users with post-editing access before storing it and rendering it on the public event page, allowing users with the Author role and above to inject arbitrary...