CVE-2025-13842 Breadcrumb NavXT <= 7.5.0 - Missing Authorization to Sensitive Information Exposure

The Breadcrumb NavXT plugin for WordPress is vulnerable to authorization bypass through user-controlled key in versions up to and including 7.5.0. This is due to the Gutenberg block renderer trusting the $REQUEST'postid' parameter without verification in the...

CVE-2025-13842 Breadcrumb NavXT <= 7.5.0 - Missing Authorization to Sensitive Information Exposure

The Breadcrumb NavXT plugin for WordPress is vulnerable to authorization bypass through user-controlled key in versions up to and including 7.5.0. This is due to the Gutenberg block renderer trusting the $REQUEST'postid' parameter without verification in the...

CVE-2025-13842

CVE-2025-13842 applies to the Breadcrumb NavXT WordPress plugin, affected up to version 7.5.0. The underlying issue is an authorization bypass: the Gutenberg block renderer trusts the $_REQUEST['post_id'] in includes/blocks/build/breadcrumb-trail/render.php, enabling unauthenticated users to enum...

CVE-2026-1646 Advance Block Extend <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via TitleColor Block Attribute

The Advance Block Extend plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TitleColor block attribute in the Latest Posts Gutenberg block in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-1646 Advance Block Extend <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via TitleColor Block Attribute

The Advance Block Extend plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TitleColor block attribute in the Latest Posts Gutenberg block in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-1646

CVE-2026-1646 affects the Advance Block Extend WordPress plugin (versions up to and including 1.0.4). The issue is a Stored Cross-Site Scripting (XSS) in the TitleColor attribute of the Latest Posts Gutenberg block, caused by insufficient input sanitization and output escaping. Exploitation requi...

WordPress plugin Endless Posts Navigation has a security vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

PT-2026-20700

Missing Authorization vulnerability in Fahad Mahmood Endless Posts Navigation endless-posts-navigation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Endless Posts Navigation: from n/a through = 2.2.9...

CVE-2026-1646: Improper Neutralization of Input During Web Page Generation

The Advance Block Extend plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TitleColor block attribute in the Latest Posts Gutenberg block in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-1219: Authorization Bypass Through User-Controlled Key

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 4.0 to 5.10 via the 'loadtracknoteajax' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers...

PT-2026-20607

The Breadcrumb NavXT plugin for WordPress is vulnerable to authorization bypass through user-controlled key in versions up to and including 7.5.0. This is due to the Gutenberg block renderer trusting the $ REQUEST'post id' parameter without verification in the...

PT-2026-20776

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 4.0 to 5.10 via the 'load track note ajax' due to missing validation on a user controlled key. This makes it possible for unauthenticated...

PT-2026-20638

Name of the Vulnerable Software and Affected Versions Advance Block Extend plugin for WordPress versions through 1.0.4 Description The Advance Block Extend plugin for WordPress has a Stored Cross-Site Scripting issue. This is due to insufficient input sanitization and output escaping in the...

CVE-2026-25332: Missing Authorization

Missing Authorization vulnerability in Fahad Mahmood Endless Posts Navigation endless-posts-navigation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Endless Posts Navigation: from n/a through = 2.2.9...

CVE-2025-70147

creationtimestamp| type| source ---|---|--- 2026-02-18 19:37:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mf5tcjlz5b2s 2026-02-18 19:37:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mf5tdgzstj2n...

CVE-2025-70148

creationtimestamp| type| source ---|---|--- 2026-02-18 18:32:13+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mf5pnyqhuz2h 2026-02-18 19:00:24+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mf5rahomoq2k...

CVE-2026-2507

creationtimestamp| type| source ---|---|--- 2026-02-18 17:23:26+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mf5lt2ytbd25 2026-02-18 17:23:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mf5ltgkt3r2c 2026-02-18 17:24:19+00:00| seen|...

CVE-2025-60035

creationtimestamp| type| source ---|---|--- 2026-02-18 14:18:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mf5biceh3r2n 2026-02-18 14:18:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mf5bj4fgfo2d 2026-02-19 05:00:00+00:00| seen|...

CVE-2025-33253

creationtimestamp| type| source ---|---|--- 2026-02-18 14:18:20+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mf5bi3a7bc2s 2026-02-18 14:18:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mf5biuzxew25...

CVE-2025-33252

creationtimestamp| type| source ---|---|--- 2026-02-18 14:18:12+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mf5bhtpgd72s 2026-02-18 14:18:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mf5bio2fvx2s...