CVE-2026-4066

The Smart Custom Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relationalpostssearch function in all versions up to, and including, 5.0.6. This makes it possible for authenticated attackers, with Contributor-level access and abov...

CVE-2025-60947

creationtimestamp| type| source ---|---|--- 2026-03-23 22:44:26+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhr55hi7rl27 2026-03-23 23:19:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhr73jy6su2i 2026-03-24 01:32:09+00:00| seen|...

CVE-2026-32300

creationtimestamp| type| source ---|---|--- 2026-03-23 22:43:19+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhr53h7zwd27 2026-03-23 23:04:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhr6bxm56l2g 2026-03-24 23:00:14+00:00| seen|...

CVE-2026-32277

creationtimestamp| type| source ---|---|--- 2026-03-23 22:30:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhr4fda2qx24 2026-03-23 22:31:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhr4g4gzxc2q 2026-03-23 22:36:07+00:00| seen|...

CVE-2026-32276

creationtimestamp| type| source ---|---|--- 2026-03-23 22:30:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhr4f4hwqo2c 2026-03-23 22:31:16+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhr4fviqoh2f 2026-03-23 23:34:10+00:00| seen|...

CVE-2026-32913

creationtimestamp| type| source ---|---|--- 2026-03-23 22:29:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhr4cjbbof2e 2026-03-23 23:14:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhr6slkvs22p 2026-03-24 12:00:04+00:00| published-proof-of-concept|...

CVE-2026-4066

The CVE concerns the Smart Custom Fields plugin for WordPress (affected: all versions up to and including 5.0.6). A missing capability check in relational_posts_search() allows authenticated users with Contributor-level access or higher to read private and draft posts from other authors via the s...

CVE-2026-4066

The Smart Custom Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relationalpostssearch function in all versions up to, and including, 5.0.6. This makes it possible for authenticated attackers, with Contributor-level access and abov...

CVE-2026-4066 Smart Custom Fields <= 5.0.6 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Relational Post Search

The Smart Custom Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relationalpostssearch function in all versions up to, and including, 5.0.6. This makes it possible for authenticated attackers, with Contributor-level access and abov...

CVE-2026-4066 Smart Custom Fields <= 5.0.6 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Relational Post Search

The Smart Custom Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relationalpostssearch function in all versions up to, and including, 5.0.6. This makes it possible for authenticated attackers, with Contributor-level access and abov...

WordPress WP Posts Re-order plugin <= 1.0 - Cross-Site Request Forgery to Settings Update vulnerability

Cross-Site Request Forgery to Settings Update vulnerability discovered by Muhammad Nur Ibnu Hubab Ibnu - Pondok Teknologi in WordPress Plugin WP Posts Re-order versions = 1.0...

WordPress Weaver Show Posts plugin <= 1.8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Additional Classes to Wrap Posts' Widget Setting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting via 'Additional Classes to Wrap Posts' Widget Setting vulnerability discovered by Muqsith Barru - TCC in WordPress Plugin Weaver Show Posts versions = 1.8.1...

WordPress Show Posts list plugin <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by zakaria in WordPress Plugin Show Posts list versions = 1.1.0...

CVE-2026-21732

creationtimestamp| type| source ---|---|--- 2026-03-23 16:13:34+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhqhcjhvsc2n 2026-03-23 16:14:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhqhddhk452s...

CVE-2026-33697

creationtimestamp| type| source ---|---|--- 2026-03-23 15:52:32+00:00| confirmed| https://github.com/ultravioletrs/cocos/security/advisories/GHSA-vfgg-mvxx-mgg7 2026-03-27 01:00:02+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhyw4nni6v2s 2026-03-27 01:00:25+00:00| seen|...

CVE-2026-33351

creationtimestamp| type| source ---|---|--- 2026-03-23 14:38:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhqbylbqeg2k 2026-03-23 15:03:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhqdfezibg2u 2026-03-29 19:40:09+00:00| seen|...

CVE-2026-3635

creationtimestamp| type| source ---|---|--- 2026-03-23 14:08:43+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mhqadbkbw22i 2026-03-23 14:10:58+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mhqahaep2k2i 2026-03-23 16:03:12+00:00| seen|...

CVE-2026-32968

creationtimestamp| type| source ---|---|--- 2026-03-23 11:20:00+00:00| seen| https://infosec.exchange/users/certvde/statuses/116278217950836584 2026-03-23 11:20:05+00:00| seen| https://bsky.app/profile/certvde.infosec.exchange.ap.brid.gy/post/3mhpwvnutx3d2 2026-03-23 11:20:27+00:00| seen|...

CVE-2026-32969

creationtimestamp| type| source ---|---|--- 2026-03-23 11:20:00+00:00| seen| https://infosec.exchange/users/certvde/statuses/116278217950836584 2026-03-23 11:20:05+00:00| seen| https://bsky.app/profile/certvde.infosec.exchange.ap.brid.gy/post/3mhpwvnutx3d2 2026-03-23 11:20:27+00:00| seen|...

CVE-2026-4599

creationtimestamp| type| source ---|---|--- 2026-03-23 06:18:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhpg2nrlsg2s 2026-03-23 06:44:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhphjlw4wc2v 2026-03-23 10:30:27+00:00| seen|...