8088 matches found
CVE-2026-85571: Authorization Bypass Through User-Controlled Key
The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course the requester manages, allowing users with instructor level access to reassign the parent of any post on the site, taking other instructors' course content...
CVE-2026-105989: Missing Authorization
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments...
PT-2026-107830
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any...
EUVD-2026-92771
Ghost: Authorization Issue Allowed Author Role to Delete any Post...
GHSA-X3MG-Q38V-M562 Ghost: Authorization Issue Allowed Author Role to Delete any Post
Impact Staff with the Author role could delete posts and pages that they did not author. Vulnerable versions This vulnerability is present in Ghost from v5.81.0 up to v6.60.0. Patches v6.60.0 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost...
Ghost: Authorization Issue Allowed Author Role to Delete any Post
Impact Staff with the Author role could delete posts and pages that they did not author. Vulnerable versions This vulnerability is present in Ghost from v5.81.0 up to v6.60.0. Patches v6.60.0 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost...
WordPress Core <= 7.1.2 - Author+ Broken Access Control to Sticky Posts via REST API vulnerability
Author+ Broken Access Control to Sticky Posts via REST API vulnerability discovered by Anthropic in WordPress core versions = 7.1.2...
CVE-2026-40806
Unauthenticated Cross Site Scripting XSS in Blog, Posts and Category Filter for Elementor = 2.1.0 versions...
CVE-2026-39796
Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily = 1.0.8 versions...
CVE-2026-40806 WordPress Blog, Posts and Category Filter for Elementor plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Blog, Posts and Category Filter for Elementor = 2.1.0 versions...
CVE-2026-40806 WordPress Blog, Posts and Category Filter for Elementor plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Blog, Posts and Category Filter for Elementor = 2.1.0 versions...
CVE-2026-40806
The Blog, Posts and Category Filter for Elementor plugin for WordPress is vulnerable to an unauthenticated Cross-Site Scripting (XSS) vulnerability in versions
EUVD-2026-93043
Unauthenticated Cross Site Scripting XSS in Blog, Posts and Category Filter for Elementor = 2.1.0 versions...
CVE-2026-39796 WordPress Advanced Posts Listing – Show Post List Easily plugin <= 1.0.8 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily = 1.0.8 versions...
EUVD-2026-93040
Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily = 1.0.8 versions...
CVE-2026-39796
The Advanced Posts Listing – Show Post List Easily WordPress plugin (versions
CVE-2026-39796 WordPress Advanced Posts Listing – Show Post List Easily plugin <= 1.0.8 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily = 1.0.8 versions...
CVE-2026-39796: Missing Authorization
Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily = 1.0.8 versions...
CVE-2026-40806: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Blog, Posts and Category Filter for Elementor = 2.1.0 versions...