CVE-2026-19613

The ECS WordPress plugin before 4.3.10 fails to enforce ownership or post-status checks for a dynamic repeater ACF data source that reads custom field values from a user-supplied post identifier. This allows users with contributor-level accounts or higher to read custom field values and post meta...

CVE-2026-17515

The MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin (affected: before 7.0.4) exposes an AJAX action with missing authorization and CSRF checks. This allows any authenticated user (e.g., a subscriber) to read the plugin’s import log file and import-related metadata ass...

CVE-2026-30889 Discourse has Unauthorized Post Data Exposure in discourse-user-notes

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a moderator could exploit insufficient authorization checks to access metadata of posts they should not have permission to view. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain...

CVE-2026-2268

The Ninja Forms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.14.0. This is due to the unsafe application of the ninjaformsmergetags filter to user-supplied input within repeater fields, which allows the resolution of postmeta:KEY mer...

EUVD-2023-59098

Malicious code in bioql PyPI...

EUVD-2023-59236

Malicious code in bioql PyPI...

CVE-2023-6897

The EAN for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.9.2 via the the 'algwceanproductmeta' shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...