8088 matches found
CVE-2026-89031
The Adenion Blog2Social WordPress plugin before version 9.1.0 is affected by a broken access control vulnerability in the b2s_calendar_move_post AJAX handler (includes/Ajax/Post.php). The handler issues an UPDATE against the b2s_posts table using only the attacker-supplied b2s_id primary key with...
CVE-2026-89031 Blog2Social WordPress Plugin < 9.1.0 Broken Access Control via b2s_calendar_move_post
Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2scalendarmovepost AJAX handler in includes/Ajax/Post.php issues an UPDATE against the b2sposts table using only the attacker-supplied b2sid primary key with...
CVE-2026-82124
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public...
CVE-2026-82124
The Schema & Structured Data for WP & AMP WordPress plugin (versions before 1.66 ) contains a vulnerability where it fails to verify if a post is password-protected before including its content in generated structured data. This flaw allows unauthenticated users to obtain the content of password-...
EUVD-2026-80187
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public...
CVE-2026-82126 Schema & Structured Data for WP & AMP 1.63 - 1.65 - Contributor+ Non-Public Post Content Disclosure via AI Schema Generation
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the specific post they request schema generation for, allowing users with the contributor role and above to obtain the content of other users' draft, pending, private and password...
Malicious code in plogme (npm)
plogme is a renamed fork of the Baileys WhatsApp Web library from the same publisher-controlled family as @crysnovax/baileys MAL-2026-15917, and versions 1.0.0 through 1.0.3 carry the same forced-follow and fingerprint modules. lib/Utils/channel-policy.js javascript-obfuscator output, identical t...
PT-2026-93763
Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2s calendar move post AJAX handler in includes/Ajax/Post.php issues an UPDATE against the b2s posts table using only the attacker-supplied b2s id primary key...
CVE-2026-89031: Authorization Bypass Through User-Controlled Key
Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2scalendarmovepost AJAX handler in includes/Ajax/Post.php issues an UPDATE against the b2sposts table using only the attacker-supplied b2sid primary key with...
CVE-2026-85131: Cross-Site Request Forgery (CSRF)
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items to its own records, allowing attackers to make a logged in admin permanently delete arbitrary posts...
CVE-2026-82124: Exposure of Sensitive Information to an Unauthorized Actor
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public...
PT-2026-93762
Name of the Vulnerable Software and Affected Versions Blog2Social plugin for WordPress versions prior to 9.1.0 Description Low-privileged accounts can access the email addresses of all registered WordPress users. The issue occurs because the b2s search user AJAX handler in includes/Ajax/Get.php...
PT-2026-93288
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public...
CVE-2026-73945
creationtimestamp| type| source ---|---|--- 2026-09-15 22:00:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvlmqa2bfw2j 2026-09-15 22:09:24+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvlnathuqv25 2026-09-22 03:37:07+00:00| seen|...
CVE-2026-76443
creationtimestamp| type| source ---|---|--- 2026-09-14 17:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mviocanazr2f 2026-09-14 18:09:03+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvipe5mx322g 2026-09-14 18:32:41+00:00| seen|...
CVE-2026-88802: Missing Authorization
The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing...
CVE-2026-54047
creationtimestamp| type| source ---|---|--- 2026-09-11 17:30:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvb3rquccx2f 2026-09-11 18:08:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hh4d5o26wjn56 2026-09-11 18:08:41+00:00| seen|...
WordPress Weaver Show Posts plugin < 1.8.1 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Do Xuan Trung in WordPress Plugin Weaver Show Posts versions 1.8.1...
CVE-2026-86782: Authorization Bypass Through User-Controlled Key
The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts...
CVE-2026-89086
creationtimestamp| type| source ---|---|--- 2026-09-10 21:00:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mv6x2w74gh24 2026-09-10 22:08:09+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv72tzbqc522 2026-09-10 22:20:04+00:00| seen|...