8088 matches found
CVE-2026-111213
The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-109979
The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.0.0 via the 'rp4wpcreatelink' parameter of the hidden 'rp4wplinkrelated' admin page. The handlecreatelink handler verifies the nonce and that the current user c...
CVE-2026-109980
The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the 'rp4wpview' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the titles and...
EUVD-2026-111598
The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-109980 Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_view' Parameter
The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the 'rp4wpview' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the titles and...
CVE-2026-109980
The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 3.0.0 . The vulnerability exists in the 'rp4wp_view' parameter due to missing authorization checks. Authenticated attackers with Contributor-level access or hig...
CVE-2026-109980 Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_view' Parameter
The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the 'rp4wpview' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the titles and...
EUVD-2026-111754
The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the 'rp4wpview' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the titles and...
CVE-2026-109979
The Related Posts for WordPress plugin for WordPress, versions up to and including 3.0.0 , is vulnerable to Sensitive Information Exposure due to a missing authorization check. The handle_create_link() handler fails to verify if a user has permission to read the child post IDs provided via the rp...
CVE-2026-109979 Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_create_link' Parameter
The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.0.0 via the 'rp4wpcreatelink' parameter of the hidden 'rp4wplinkrelated' admin page. The handlecreatelink handler verifies the nonce and that the current user c...
EUVD-2026-111747
The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.0.0 via the 'rp4wpcreatelink' parameter of the hidden 'rp4wplinkrelated' admin page. The handlecreatelink handler verifies the nonce and that the current user c...
CVE-2026-110507
The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are allowed to read, which could allow users with the contributor role and above to read the content of other users' draft,...
PT-2026-127868
The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.0.0 via the 'rp4wp create link' parameter of the hidden 'rp4wp link related' admin page. The handle create link handler verifies the nonce and that the current...
PT-2026-127869
The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the 'rp4wp view' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the titles and...
PT-2026-127878
The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
WordPress Related Posts for WordPress plugin <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure vulnerability
Missing Authorization to Authenticated Contributor+ Sensitive Information Exposure vulnerability discovered by Wordfence PRISM in WordPress Plugin Related Posts for WordPress versions = 3.0.0...
WordPress Related Posts for WordPress plugin <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure vulnerability
Missing Authorization to Authenticated Contributor+ Sensitive Information Exposure vulnerability discovered by Wordfence PRISM in WordPress Plugin Related Posts for WordPress versions = 3.0.0...
CVE-2026-94267
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary...
CVE-2026-109934
The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public, allowing unauthenticated users to read manual excerpts of password-protecte...
EUVD-2026-108604
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary...