CVE-2026-104667

The Animated Number Counters WordPress plugin (versions before 3.1 ) is vulnerable to a second-order SQL injection (CWE-89). The root cause is the failure to sanitize or escape values stored by a user with Editor-level privileges before they are concatenated into a SQL query. This query is execut...

CVE-2026-104652

The Envira Gallery WordPress plugin, in versions prior to 1.16.1 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to sanitize and escape a gallery item identifier before it is outputted into an image tag attribute . This allows users with the Author role ...

EUVD-2026-94177

The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting user is authorized to access before returning that question's answer options, allowing any authenticated user with access to a single course, such as an enrolled student, to rea...

CVE-2026-104050

The Academy LMS WordPress plugin versions before 4.0.0 is vulnerable to a cross-course quiz answer disclosure. The plugin fails to verify if a quiz question belongs to a course the requesting user is authorized to access before returning the answer options via the render_quiz_answers function. Th...

CVE-2026-104651

The Yaad Sarig Payment Gateway For WC WordPress plugin, in versions before 2.2.13 , is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to verify authorization or ownership of the target order during several order payment-processing actions . This allows any authent...

CVE-2026-104677 WP Coder 4.0 - 4.5.1 - Editor+ RCE via Global PHP

The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromi...

EUVD-2026-94174

The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attacker...

CVE-2026-103378 Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Public Log File

The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attacker...

EUVD-2026-94175

The Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capability check in one of its AJAX actions, allowing authenticated users with low privileges, such as subscribers, to delete the Frontend Dashboard WordPress plugin before 3.0.0's configured profile and post form fields...

CVE-2026-104049 Academy LMS < 4.0.0 - Subscriber+ Arbitrary Lesson Content Disclosure via Topic REST Endpoint

The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST API routes, allowing users with a self-registerable student account to read the full content of arbitrary lessons, including lessons of pai...

CVE-2026-103681

The Frontend Dashboard WordPress plugin (versions before 3.0.0 ) is vulnerable to an improper access control issue (CWE-284) in one of its AJAX actions . Specifically, the plugin fails to perform a necessary capability check , allowing authenticated users with low privileges, such as subscribers ...

CVE-2026-103378 Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Public Log File

The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attacker...

CVE-2026-106501

A flaw was found in @backstage/plugin-scaffolder-backend. An authenticated user with permission to view another user's Scaffolder task can retrieve internal task execution data, leading to sensitive information disclosure. If this execution data contains credentials for external services, an...

CVE-2026-106489

A flaw was found in the Backstage TechDocs backend plugin. An authenticated user with access to at least one documentation site can craft a request to bypass access controls when permissions and external storage are enabled. This flaw allows an attacker to view restricted documentation belonging ...

CVE-2026-106460

A flaw was found in the @backstage/plugin-auth-node package. This vulnerability allows an authenticated attacker to achieve privilege escalation by assuming another user's catalog identity and gaining their access permissions. The issue occurs because the component does not consistently enforce...

CVE-2026-106505

A flaw was found in the plugin-techdocs-node component of Backstage. This vulnerability allows an attacker with permission to commit changes to a repository utilizing TechDocs to bypass the MkDocs configuration sanitizer. By supplying a crafted configuration file, the attacker can achieve arbitra...

CVE-2026-106455

A flaw was found in the Backstage @backstage/plugin-techdocs-node package. This vulnerability allows information disclosure when an authenticated attacker with control over a TechDocs documentation repository exploits improper validation of MkDocs plugin configurations. During documentation build...

CVE-2026-106498

A flaw was found in @backstage/plugin-catalog-backend. An authenticated remote user can craft a catalog entity containing placeholder directives that reference resources outside the entity's source repository due to improper URL validation. Under certain configurations, this can lead to informati...

CVE-2026-106500

A flaw was found in @backstage/plugin-scaffolder-backend. Due to improper task state validation, an authenticated user with permissions to create and access Scaffolder tasks can affect files accessible to the Backstage backend under specific timing and deployment conditions. If the backend...

PT-2026-107406

The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player configurations and change a CP Media Player WordPress plugin...