CVE-2026-87071 Forminator Forms < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted Posts

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys WordPress reserves for its own use, so unauthenticated visitors submitting a public form that collects post content can attach metadata of their...

CVE-2026-88929

The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin (versions 7.0.0-7.5.1 ) is vulnerable to an unauthenticated non-public product disclosure . The flaw exists because the plugin fails to verify if a product is published before returning its details to unauthenticated users...

CVE-2026-88929 Sale Booster 7.0.0 - 7.5.1 - Unauthenticated Non-Public Product Disclosure

The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin before 7.5.2 does not check whether a product is published before returning its details to unauthenticated users, allowing them to read the title, description and price of draft, pending and private products...

CVE-2026-89331 FluentBoards 1.95 - 2.0.15 - Unauthenticated Board Member Email Address Disclosure via Public Board Endpoints

The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthenticated users to disclose the email addresses of a shared board's members, typically including administrators...

WordPress Product Badge, Label, Countdown Timer for WooCommerce plugin 7.0.0-7.5.1 - Unauthenticated Non-Public Product Disclosure vulnerability

Unauthenticated Non-Public Product Disclosure vulnerability discovered by Que Thanh Tuan in WordPress Plugin Product Badge, Label, Countdown Timer for WooCommerce versions 7.0.0-7.5.1...

CVE-2026-88929 Sale Booster 7.0.0 - 7.5.1 - Unauthenticated Non-Public Product Disclosure

The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin before 7.5.2 does not check whether a product is published before returning its details to unauthenticated users, allowing them to read the title, description and price of draft, pending and private products...

CVE-2026-89331 FluentBoards 1.95 - 2.0.15 - Unauthenticated Board Member Email Address Disclosure via Public Board Endpoints

The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthenticated users to disclose the email addresses of a shared board's members, typically including administrators...

WordPress WP Recipe Maker plugin < 10.8.2 - Subscriber+ Non-Public List Title Disclosure vulnerability

Subscriber+ Non-Public List Title Disclosure vulnerability discovered by Abdullah Kareem in WordPress Plugin WP Recipe Maker versions 10.8.2...

CVE-2026-84741 The Events Calendar 4.5 - 6.17.4.1 - Unauthenticated Non-Public Venue and Organizer Disclosure via REST API

The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published...

WordPress The Events Calendar plugin 4.5-6.17.4 - Unauthenticated Non-Public Venue and Organizer Disclosure vulnerability

Unauthenticated Non-Public Venue and Organizer Disclosure vulnerability discovered by Kaveesha Nirmal in WordPress Plugin The Events Calendar versions 4.5-6.17.4...

CVE-2026-84741 The Events Calendar 4.5 - 6.17.4.1 - Unauthenticated Non-Public Venue and Organizer Disclosure via REST API

The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published...

CVE-2026-96258

A vulnerability has been found in onSite internet GmbH Auktion NG Auktionssoftware up to 20260722. This affects an unknown part of the file /forgotpasswd.html of the component Public Password Reset Endpoint. The manipulation of the argument email leads to cross site scripting. The attack is...

EUVD-2026-85015

A vulnerability has been found in onSite internet GmbH Auktion NG Auktionssoftware up to 20260722. This affects an unknown part of the file /forgotpasswd.html of the component Public Password Reset Endpoint. The manipulation of the argument email leads to cross site scripting. The attack is...

CVE-2026-96258 onSite internet GmbH Auktion NG Auktionssoftware Public Password Reset Endpoint forgotpasswd.html cross site scripting

A vulnerability has been found in onSite internet GmbH Auktion NG Auktionssoftware up to 20260722. This affects an unknown part of the file /forgotpasswd.html of the component Public Password Reset Endpoint. The manipulation of the argument email leads to cross site scripting. The attack is...

CVE-2026-96258

A cross-site scripting (XSS) vulnerability exists in the Public Password Reset Endpoint of onSite internet GmbH Auktion NG Auktionssoftware (versions up to 20260722). The flaw is located within the /forgotpasswd.html file, where manipulating the email argument allows for remote execution of the a...

CVE-2026-96258 onSite internet GmbH Auktion NG Auktionssoftware Public Password Reset Endpoint forgotpasswd.html cross site scripting

A vulnerability has been found in onSite internet GmbH Auktion NG Auktionssoftware up to 20260722. This affects an unknown part of the file /forgotpasswd.html of the component Public Password Reset Endpoint. The manipulation of the argument email leads to cross site scripting. The attack is...

PT-2026-97152

Name of the Vulnerable Software and Affected Versions onSite internet GmbH Auktion NG Auktionssoftware versions prior to 20260722 Description A remote cross site scripting issue exists within the Public Password Reset Endpoint component. The flaw occurs in the /forgotpasswd.html endpoint when the...

PT-2026-97190

Name of the Vulnerable Software and Affected Versions FluentBoards WordPress plugin versions prior to 2.1.0 Description The public, token-shared board feature fails to properly restrict the member data it returns. This allows unauthenticated users to disclose the email addresses of members...

CVE-2026-96258: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in onSite internet GmbH Auktion NG Auktionssoftware up to 20260722. This affects an unknown part of the file /forgotpasswd.html of the component Public Password Reset Endpoint. The manipulation of the argument email leads to cross site scripting. The attack is...

NPM: 9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header

NPM: 9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header vulnerability discovered by ? in WordPress Npm 9router versions = 0.5.4...