CVE-2026-84742

The Events Calendar WordPress plugin, affecting versions 6.15.0 through 6.17.4 , contains an incorrect authorization vulnerability. The plugin fails to verify the necessary capabilities required to publish content when creating or updating entries via its REST API . This allows users with restric...

CVE-2026-84743

The Events Calendar WordPress plugin (versions 6.15.16.1 through 6.17.4 ) is vulnerable to an incorrect authorization flaw. The plugin fails to perform per-object capability checks on a specific family of REST write routes (specifically those using by-slug ). This allows users with low-privilege ...

CVE-2026-84741

The Events Calendar WordPress plugin (versions 4.5 - 6.17.4 ) is vulnerable to an unauthenticated information disclosure. The application fails to verify the post status of linked records before embedding their details into a public REST API response. This oversight allows unauthenticated users t...

EUVD-2026-85040

The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including...

CVE-2026-84742 The Events Calendar 6.15.0 - 6.17.4.1 - Contributor+ Content Publication via TEC V1 REST API

The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review...

EUVD-2026-85039

The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review...

EUVD-2026-85038

The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published...

CVE-2026-84743 The Events Calendar 6.15.16.1 - 6.17.4.1 - Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes

The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including...

CVE-2026-84026 Directorist 8.1 - 8.9.4 - Unauthenticated Sensitive Data Disclosure via REST Users Endpoint

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not restrict access to a REST endpoint that returns user records, allowing unauthenticated attackers to read registered users' private contact details...

CVE-2026-84027 Directorist 8.9.1 - 8.9.4 - Subscriber+ Paid Order and Payment Record Forgery via REST Orders Endpoint

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its REST API, allowing users with the subscriber role and above to create paid order and payment records with arbitrary amounts and...

EUVD-2026-85032

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not restrict access to a REST endpoint that returns user records, allowing unauthenticated attackers to read registered users' private contact details...

CVE-2026-84027

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions 8.9.1-8.9.4 is vulnerable to a paid order and payment record forgery vulnerability. The root cause is a failure to check user capabilities when creating orders via the plugin's REST API . This allo...

EUVD-2026-85033

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its REST API, allowing users with the subscriber role and above to create paid order and payment records with arbitrary amounts and...

CVE-2026-84026

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions 8.1 through 8.9.4 contains a vulnerability that fails to restrict access to a REST endpoint used for returning user records. This flaw allows unauthenticated attackers to access and read private co...

CVE-2026-77766 Directorist 8.5 - 8.9.4 - Subscriber+ Order and Financial Record Disclosure via REST Orders Endpoint

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not scope one of its REST collection endpoints to the requesting user, allowing users with a subscriber-level account to read every customer's order and payment records. Versions 8.8.1 to...

EUVD-2026-85026

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not scope one of its REST collection endpoints to the requesting user, allowing users with a subscriber-level account to read every customer's order and payment records. Versions 8.8.1 to...

CVE-2026-77766

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin (versions 8.5-8.9.4 ) contains a vulnerability where one of its REST collection endpoints is not properly scoped to the requesting user. This flaw allows users with a subscriber-level account to access and ...

CVE-2026-86785

The Social Commerce for WooCommerce WordPress plugin, version 2.5.4 and below , is vulnerable to an unauthenticated privilege escalation. The root cause is a lack of authorization checks on specific REST API endpoints , which allows attackers to modify the plugin's configuration and product synch...

EUVD-2026-85019

The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticated users to update Social Commerce for WooCommerce WordPress plugin through 2.5.4 configuration and product synchronisation state...

CVE-2026-86785 Social Commerce for WooCommerce <= 2.5.4 - Unauthenticated Plugin Option and Product Sync Status Update

The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticated users to update Social Commerce for WooCommerce WordPress plugin through 2.5.4 configuration and product synchronisation state...