CVE-2026-10095

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtext' parameter in all versions up to, and including, 9.1.13.005 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-54309

creationtimestamp| type| source ---|---|--- 2026-07-01 11:07:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mplesml2b72x...

CVE-2026-12754

creationtimestamp| type| source ---|---|--- 2026-07-01 10:53:02+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpldzhdbjz2q 2026-07-01 12:47:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mplkgjf5hb26 2026-07-01 16:16:07+00:00| seen|...

CVE-2026-13454

creationtimestamp| type| source ---|---|--- 2026-07-01 10:51:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpldwfzwlj2q 2026-07-01 11:40:34+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mplgoh6jhd2h 2026-07-01 12:39:40+00:00| seen|...

CVE-2025-15666

creationtimestamp| type| source ---|---|--- 2026-07-01 10:35:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpld2ms3222b...

CVE-2026-11880

creationtimestamp| type| source ---|---|--- 2026-07-01 10:06:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mplbg73rr52h 2026-07-01 11:38:38+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mplgkyekfd2p...

CVE-2026-11562

creationtimestamp| type| source ---|---|--- 2026-07-01 09:56:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mplau54uab2k...

CVE-2026-56016

creationtimestamp| type| source ---|---|--- 2026-07-01 09:17:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpl6nzkpfa2o 2026-07-01 17:06:41+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mplyvlt3kg2f...

CVE-2026-12732

creationtimestamp| type| source ---|---|--- 2026-07-01 09:15:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpl6l7fscm2q 2026-07-01 09:15:37+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpl6l7vt242g 2026-07-01 11:44:12+00:00| seen|...

CVE-2026-12576

creationtimestamp| type| source ---|---|--- 2026-07-01 09:15:07+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpl6kdys6y24 2026-07-01 15:28:52+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpltgntsxe2b 2026-07-02 01:14:33+00:00| seen|...

CVE-2026-10540

creationtimestamp| type| source ---|---|--- 2026-07-01 09:13:23+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpl6hbhxtg26 2026-07-01 12:28:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpljddvzy32y 2026-07-01 15:28:30+00:00| seen|...

CVE-2026-7831

creationtimestamp| type| source ---|---|--- 2026-07-01 09:08:39+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mpl66slbsd2l...

CVE-2026-12435

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.111. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-10096 Qi Blocks <= 1.4.9 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Style Modification via 'page_id' Parameter

The Qi Blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.4.9 via the 'pageid' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, t...

EUVD-2026-40937

The Slim SEO – A Fast & Automated SEO Plugin For WordPress plugin for WordPress is vulnerable to Unauthorized Private Content Disclosure in all versions up to, and including, 4.9.8 via the /wp-json/slim-seo/meta-tags/ai REST API endpoint. This is due to the endpoint's permissioncallback performin...

CVE-2026-12435

The Motors – Car Dealership & Classified Listings Plugin for WordPress is affected up to version 1.4.111 by an authorization bypass. An authenticated user with subscriber-level access can mark or unmark another user’s car listing as Sold by replaying a valid nonce from their own listing against a...

CVE-2026-12435 Motors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.111. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

EUVD-2026-40935

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.111. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-20462

creationtimestamp| type| source ---|---|--- 2026-07-01 05:09:18+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpkqssa4si2l 2026-07-02 06:24:28+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnfi5dbuk2u 2026-07-02 19:16:31+00:00| seen|...

EUVD-2026-40902

The Custom Payment Gateways for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'algwccpginputfields' parameter in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...