CVE-2026-88876

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/PlayerSkins/seo.php that allows unauthenticated attackers to access password-protected video sources by calling getSources without password validation. Attackers can request t...

CVE-2026-88876

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization flaw in plugin/PlayerSkins/seo.php. The getSources() function is invoked without validating the configured password, allowing an unauthenticated attacker to request the seo.php endpoint with a video ...

CVE-2022-46484

CVE-2022-46484 Data Illusion Survey Software Solutions NGSurvey v2.4.28 以下において、パスワードで保護された調査における情報漏洩により、攻撃者はパスワードを表示して調査にアクセスし、任意に送信することが可能になります。...

CVE-2026-78149

The Smart Post WordPress plugin (Post Grid, Post Carousel, & List Category Posts) versions 4.0.0 through 4.0.7 are affected by an unauthenticated information disclosure vulnerability in the sp_handle_post_id AJAX action. The plugin fails to check whether a post is password-protected before return...

EUVD-2026-71849

The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored password through an unauthenticated AJAX action, allowing unauthenticated users to read protected post content and the password that guards it...

CVE-2026-78149 Post Carousel 4.0.0 - 4.0.7 - Unauthenticated Password-Protected Post Content and post_password Disclosure via sp_handle_post_id

The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored password through an unauthenticated AJAX action, allowing unauthenticated users to read protected post content and the password that guards it...

PT-2026-86332

🚨 CVE-2026-78149 The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored password through an unauthenticated AJAX action, allowing unauthenticated users to read protected post content and the password that guards...

EUVD-2026-57452

SiYuan: Tag labels from password-protected documents are returned to readers who have not entered the password...

GHSA-MP7R-57W4-5QM3 SiYuan: Tag labels from password-protected documents are returned to readers who have not entered the password

CVE: This vulnerability corresponds to CVE-2026-72792. Summary /api/tag/getTag filters its results for reader roles through FilterTagsByPublishIgnore, which checks only the visible publish tier. Documents that are published but password-protected pass that check, so a reader who has never entered...

CVE-2025-15489

The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content...

CVE-2025-8945 Wp Edit Password Protected < 1.3.5 - Protection Bypass via REST API

The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API...

EUVD-2025-210831

The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content...

CVE-2026-77782

The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts...

CVE-2026-77782

The Rank Math SEO WordPress plugin, versions before 1.0.277.1 , fails to check whether a post is password-protected before using its content to build publicly generated SEO metadata (via post metadata and llms.txt ). This allows unauthenticated users to read the content of password-protected post...

EUVD-2026-69837

The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts...

CVE-2026-77782 Rank Math SEO < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure via Post Metadata and llms.txt

The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts...

WordPress Rank Math SEO plugin < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure vulnerability

Unauthenticated Password-Protected Post Content Disclosure vulnerability discovered by Project Black in WordPress Plugin Rank Math SEO versions 1.0.277.1...

CVE-2026-16983

The Gutentor WordPress plugin (versions before 4.0.6 ) fails to apply the correct context restriction on one of its REST endpoints , exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role. The vulnerability was discovered by Ezekie...

WordPress Gutentor plugin < 4.0.6 - Subscriber+ Password Protected Post Password Disclosure vulnerability

Subscriber+ Password Protected Post Password Disclosure vulnerability discovered by Ezekiel Victor in WordPress Plugin Gutentor versions 4.0.6...

CVE-2026-77438 Trilium unauthenticated share-search discloses password-protected and hidden shared notes

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated visitor to read the titles, tree paths, and conten...