Exploit for CVE-2026-19632

CVE-2026-19632 — TranslatePress ≤ 3.3.1 Unauthenticated Accoun...

CVE-2026-19632

The TranslatePress – Translate Multilingual sites with AI Translation WordPress plugin (versions ≤ 3.3.1 ) is vulnerable to Sensitive Information Exposure via the trp_get_translations_regular AJAX action. This flaw allows unauthenticated attackers to extract raw administrator password-reset URLs ...

CVE-2026-19892 InfusedWoo Pro <= 5.1.18 - Authenticated (Subscriber+) Privilege Escalation via Password Reset Link Disclosure

The InfusedWoo Pro plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 5.1.17. This is due to a missing capability check in the ajaxiwarpreviewemail function, which uses isadmin as its only authorization check and allows...

CVE-2026-7761

The Ultimate Member plugin for WordPress is vulnerable to Account Takeover via Password Reset Link Disclosure in all versions up to and including 2.11.4. This is due to a chain of three logic bugs: 1 an MD5 hash fallback in getdirectorybyhash that allows any post to be used as a member directory ...

CVE-2020-14930

An issue was discovered in BT CTROMS Terminal OS Port Portal CT-464. Account takeover can occur because the password-reset feature discloses the verification token. Upon a getverificationcode.jsp request, this token is transmitted not only to the registered phone number of the user account, but i...