CVE-2026-90985 WPC Smart Compare for WooCommerce < 6.6.1 - Unauthenticated Password-Protected Product Description Disclosure via woosc_load

The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not apply WordPress's post-password protection when returning product content through its comparison handler, allowing unauthenticated users to read the description of password-protected products...

CVE-2026-90985 WPC Smart Compare for WooCommerce < 6.6.1 - Unauthenticated Password-Protected Product Description Disclosure via woosc_load

The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not apply WordPress's post-password protection when returning product content through its comparison handler, allowing unauthenticated users to read the description of password-protected products...

WordPress WPC Smart Compare for WooCommerce plugin < 6.6.1 - Unauthenticated Password-Protected Product Description Disclosure vulnerability

Unauthenticated Password-Protected Product Description Disclosure vulnerability discovered by Artus KG in WordPress Plugin WPC Smart Compare for WooCommerce versions 6.6.1...

CVE-2026-90985: Exposure of Sensitive Information to an Unauthorized Actor

The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not apply WordPress's post-password protection when returning product content through its comparison handler, allowing unauthenticated users to read the description of password-protected products...

SUSE CVE-2026-68584

SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeadingTransaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retriev...

CVE-2026-82124

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public...

EUVD-2026-80187

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public...

CVE-2026-82124

The Schema & Structured Data for WP & AMP WordPress plugin (versions before 1.66 ) contains a vulnerability where it fails to verify if a post is password-protected before including its content in generated structured data. This flaw allows unauthenticated users to obtain the content of password-...

WordPress Schema & Structured Data for WP & AMP plugin < 1.66 - Unauthenticated Password-Protected Post Content Disclosure vulnerability

Unauthenticated Password-Protected Post Content Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Schema & Structured Data for WP & AMP versions 1.66...

CVE-2026-82124 Schema & Structured Data for WP & AMP < 1.66 - Unauthenticated Password-Protected Post Content Disclosure via JSON-LD Schema Output

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public...

CVE-2026-82124 Schema & Structured Data for WP & AMP < 1.66 - Unauthenticated Password-Protected Post Content Disclosure via JSON-LD Schema Output

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public...

PT-2026-93288

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public...

CVE-2026-82124: Exposure of Sensitive Information to an Unauthorized Actor

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public...

CVE-2026-16592

The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as low as Contributor to disclose non-public listing content, including password-protected and hidden fields, belonging to other users...

CVE-2026-15758

The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.16.20 via the 'id' parameter. This makes it possible for unauthenticated attackers to extract sensitive data...

CVE-2026-16592 WP Directory Kit <= 1.5.7 - Contributor+ Non-Public Listing Field Disclosure via Shortcodes

The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as low as Contributor to disclose non-public listing content, including password-protected and hidden fields, belonging to other users...

Astra Linux – Vulnerability in imagemagick

ImageMagick versions before 6.9.11-40 and 7.x before 7.0.10-40 mishandle the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized, allowing additional shell commands to be injected through...

CVE-2026-90540

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate watch permissions in the playListAddVideo.json.php endpoint when adding videos to playlists. Authenticated attackers can add password-protected videos they cannot watch to playlists they own by submitting the...

CVE-2026-90550

WWBN AVideo (through commit c3edcc27) is affected by a missing authorization vulnerability in the PlayerSkins mediaSession.json.php endpoint. The endpoint fails to verify user authorization before returning video metadata, allowing unauthenticated attackers to supply a video ID parameter and retr...

CVE-2026-90549

WWBN AVideo , a PHP-based video platform, is vulnerable to missing authorization on the videosAndroid.json.php endpoint in versions through commit c3edcc274c389816d434acadac07ee78eaf330c1. Unauthenticated attackers can send a simple GET request to the endpoint and retrieve metadata of password-pr...