22867 matches found
EUVD-2026-51698
The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor wh...
EUVD-2026-51717
The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on...
CVE-2026-15368
The CVE describes a vulnerability in the WordPress plugin User Profile Builder, affecting versions prior to 3.16.4. The flaw permits an unauthenticated attacker to obtain an authenticated session on an existing user (including administrators) by abusing the automatic login after registration on s...
CVE-2026-15368 Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration
The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on...
CVE-2026-15368
The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on...
CVE-2026-56045
creationtimestamp| type| source ---|---|--- 2026-08-01 04:44:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mrynud5suh2b...
CVE-2026-58183
creationtimestamp| type| source ---|---|--- 2026-08-01 04:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrynhrhpkt2d...
CVE-2026-58182
creationtimestamp| type| source ---|---|--- 2026-08-01 04:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mryls4ou2w22...
CVE-2026-9044
creationtimestamp| type| source ---|---|--- 2026-08-01 00:14:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/bfcbsocxijx5t 2026-08-01 21:13:58+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117022316193952123 2026-08-06 03:22:18+00:00| seen|...
CVE-2026-54909
creationtimestamp| type| source ---|---|--- 2026-08-01 00:12:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/7tqoc6v5cvlvv 2026-08-01 04:31:50+00:00| seen| https://gist.github.com/alon710/402cd5e451c20f1dfc47c5b8f0cf1ddb...
CVE-2026-57319
creationtimestamp| type| source ---|---|--- 2026-07-31 23:44:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mry53uenmt27...
CVE-2026-54768 WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)
WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This...
EUVD-2026-51676
WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This...
CVE-2026-54768 WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)
WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This...
CVE-2026-54768
WPGraphQL
CVE-2026-15971
creationtimestamp| type| source ---|---|--- 2026-07-31 20:10:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxr55g6ps2u 2026-08-01 20:06:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms2beuzq2c2z...
CVE-2026-52856
creationtimestamp| type| source ---|---|--- 2026-07-31 19:51:07+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrxq3akldl23 2026-08-02 07:02:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms3fwwqe6w2e...
CVE-2026-56054
creationtimestamp| type| source ---|---|--- 2026-07-31 19:44:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mrxpopxkbu2t...