WordPress Meow Gallery plugin < 5.5.5 - Author+ Draft and Private Post Disclosure vulnerability

Author+ Draft and Private Post Disclosure vulnerability discovered by Kaan Özbek in WordPress Plugin Meow Gallery versions 5.5.5...

CVE-2026-92423

The Meow Gallery WordPress plugin versions before 5.5.5 is vulnerable to a draft and private post disclosure. The root cause is a failure to perform proper capability checks or restrict results to the requesting user's own posts before returning data via the fetch_posts function. This allows auth...

CVE-2026-92423 Meow Gallery < 5.5.5 - Author+ Draft and Private Post Disclosure via fetch_posts

The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own posts before returning post data, allowing authenticated users with Author-level access and above to disclose the titles, authors, dates and statuses of other...

CVE-2026-82851 Masteriyo LMS 1.14.0 - 3.4.0 - Instructor+ Arbitrary Post Disclosure via IDOR

The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft...

WordPress Masteriyo LMS plugin 1.14.0-3.4.0 - Instructor+ Arbitrary Post Disclosure vulnerability

Instructor+ Arbitrary Post Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Masteriyo - LMS versions 1.14.0-3.4.0...

CVE-2026-82851

The Masteriyo LMS WordPress plugin (versions 1.14.0-3.4.0 ) contains an Insecure Direct Object Reference (IDOR) vulnerability. The plugin fails to verify ownership or restrict the type of records a user requests for download. This allows users with the instructor role to retrieve the full content...

CVE-2026-82851 Masteriyo LMS 1.14.0 - 3.4.0 - Instructor+ Arbitrary Post Disclosure via IDOR

The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft...

WordPress TaxoPress plugin < 3.51.0 - Contributor+ Private Post Disclosure via IDOR vulnerability

Contributor+ Private Post Disclosure via IDOR vulnerability discovered by Duy Tran in WordPress Plugin TaxoPress versions 3.51.0...

WordPress YMC Smart Filter plugin < 3.11.3 - Unauthenticated Private/Draft Post Disclosure vulnerability

Unauthenticated Private/Draft Post Disclosure vulnerability discovered by Ahmed Hashim Ismael in WordPress Plugin Filter & Grids versions 3.11.3...

WordPress Classified Listing plugin < 5.4.4 - Contributor+ Unpublished Post Content Disclosure via rtcl_block_css_get_posts vulnerability

Contributor+ Unpublished Post Content Disclosure via rtclblockcssgetposts vulnerability discovered by Huseyin Mertoglu in WordPress Plugin Classified Listing versions 5.4.4...

CVE-2026-15231

The Tag, Category, and Taxonomy Manager (also known as TaxoPress ) WordPress plugin, in versions before 3.51.0 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The plugin fails to verify if a user is authorized to access a referenced post before processing it and returning derived ...

CVE-2026-8825 Elementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST API

The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, privat...

CVE-2026-4812

The Advanced Custom Fields ACF plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disclosure in versions up to and including 6.7.0. This is due to AJAX field query endpoints accepting user-supplied filter parameters that override field-configured restrictions witho...

EUVD-2026-22828

The Advanced Custom Fields ACF plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disclosure in versions up to and including 6.7.0. This is due to AJAX field query endpoints accepting user-supplied filter parameters that override field-configured restrictions witho...

WordPress Context Blog theme <= 1.2.5 - Unauthenticated Private Post Disclosure vulnerability

Unauthenticated Private Post Disclosure vulnerability discovered by jsonc in WordPress Theme Context Blog versions = 1.2.5...

WordPress Shortcodes for Elementor plugin <= 1.0.4 - Authenticated (Contributor+) Post Disclosure vulnerability

Authenticated Contributor+ Post Disclosure vulnerability discovered by Francesco Carlucci in WordPress Plugin Shortcodes for Elementor versions = 1.0.4...

EUVD-2006-1693

Malware in sbrugna...

WordPress Post Lockdown plugin <= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Post Disclosure vulnerability

Missing Authorization to Authenticated Subscriber+ Post Disclosure vulnerability discovered by Krzysztof Zając in WordPress Plugin Post Lockdown versions = 4.0.2...

CVE-2025-1322 WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Authenticated (Contributor+) Protected Post Disclosure

The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 16.26.10 via the 'feed' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated...

WordPress WP-Recall plugin <= 16.26.10 - Authenticated (Contributor+) Protected Post Disclosure vulnerability

Authenticated Contributor+ Protected Post Disclosure vulnerability discovered by Krzysztof Zając in WordPress Plugin WP-Recall versions = 16.26.10...