CVE-2026-65575

creationtimestamp| type| source ---|---|--- 2026-08-06 16:12:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msggn4vxwm2a 2026-08-06 18:06:42+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3msgn22kamc2e 2026-08-06 18:06:45+00:00| seen|...

CVE-2026-64564

creationtimestamp| type| source ---|---|--- 2026-08-06 15:03:12+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/55u7vzwmlbett 2026-08-06 15:22:49+00:00| seen| https://infosec.exchange/users/harrysintonen/statuses/117049246952190178 2026-08-06 15:25:14+00:00| seen|...

CVE-2026-18970

creationtimestamp| type| source ---|---|--- 2026-08-06 11:00:40+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117048216095721886 2026-08-06 11:00:40+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3msfva7xipf2t...

CVE-2026-18400

The Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'delay' Post Meta Setting in all versions up to, and including, 3.111.0 due to insufficient input sanitization and output escaping. This makes it...

WordPress <= 5.2.4 - Unauthenticated View Private/Draft Posts

WordPress before 5.2.4 contains an information disclosure caused by mishandling of the static query property, letting unauthenticated users view certain content, exploit requires no authentication. id: CVE-2019-17671 info: name: WordPress = 5.2.4 - Unauthenticated View Private/Draft Posts author:...

WordPress Simple Job Board - Unauthorized Data Access

The Simple Job Board plugin for WordPress is vulnerable to unauthorized data access due to insufficient authorization checking in the fetchquickjob function in all versions up to and including 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be...

My Geo Posts Free <= 1.2 - PHP Object Injection

The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If ...

YMC Filter WordPress - Unauthenticated Post Disclosure

YMC Filter WordPress plugin 3.11.3 contains a broken access control vulnerability caused by improper authorization and lack of validation in a REST API endpoint, letting unauthenticated attackers retrieve private and non-public post content, exploit requires no authentication. id: CVE-2026-10823...

Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection

The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2026-11588 EONSR AEO Agent <= 3.7.9 - Unauthenticated Stored XSS via Scheduled Post Creation

The EONSR AEO Agent WordPress plugin through 3.7.9 does not perform any authorisation check on one of its REST API routes and disables HTML sanitisation before saving the post, allowing unauthenticated attackers to create administrator-attributed published posts containing arbitrary web scripts...

CVE-2026-71319

creationtimestamp| type| source ---|---|--- 2026-08-05 22:16:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msekiznbnx2z 2026-08-05 22:26:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3fsizpdnyrbkp 2026-08-05 23:01:06+00:00| seen|...

CVE-2026-20272

creationtimestamp| type| source ---|---|--- 2026-08-05 17:07:01+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3msdzafb4i22n 2026-08-05 17:22:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mse23ct2hz23 2026-08-06 05:17:16+00:00| seen|...

CVE-2026-20304

creationtimestamp| type| source ---|---|--- 2026-08-05 16:51:36+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3msdyet7jwc24 2026-08-05 17:22:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mse23e2oxs2p 2026-08-06 03:17:09+00:00| seen|...

CVE-2026-44945

creationtimestamp| type| source ---|---|--- 2026-08-05 10:24:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msdcpujkg723 2026-08-05 10:30:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/117042434875220625 2026-08-05 10:30:28+00:00| seen|...

CVE-2026-10090

creationtimestamp| type| source ---|---|--- 2026-08-05 10:18:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/gzht5h26j6cgw 2026-08-05 10:22:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msdcme5m4p2o 2026-08-05 11:31:08+00:00| seen|...

CVE-2026-10059

creationtimestamp| type| source ---|---|--- 2026-08-05 10:16:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/bxonml2lzenjs 2026-08-05 10:22:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msdcmcvyui2l 2026-08-05 11:30:28+00:00| seen|...

CVE-2026-12000

The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 1.4.0 via the WordPress core REST endpoints /wp-json/wp/v2/pages, /wp-json/wp/v2/pages/, /wp-json/wp/v2/posts, and /wp-json/wp/v2/posts/. This is due to the plugin's...

CVE-2026-16603

The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts through the core REST API...

CVE-2026-16602

The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an unauthenticated REST endpoint, allowing unauthenticated users to disclose the content of non-public draft, private, and pending posts on sites that have a captcha provider...

CVE-2026-7105 Xpro Addons <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Creation via get_menu_content_editor() Function

The Xpro Addons plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on the getmenucontenteditor function in all versions up to, and including, 1.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...