CVE-2026-14433 Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 - Unauthenticated Stored Cross-Site Scripting via REST API 'business_id' Parameter

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businessid' parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15162: Improper Neutralization of Special Elements used in an SQL Command

The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpressobjecttype parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback canprocess checks only the HTTP method for the push class — no capability or nonc...

CVE-2026-18438: Unrestricted Upload of File with Dangerous Type

The Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.7.1 via the fetchremotefile function. This is due to a filename validation/destination mismatch ...

CVE-2026-16611: Exposure of Sensitive Information to an Unauthorized Actor

The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before 13.5.7 does not perform an authorization check on one of its REST read routes, allowing unauthenticated users to disclose a store's feed configuration rules, filters and field mapping and to enumerate the full product catego...

CVE-2026-16541: Exposure of Sensitive Information to an Unauthorized Actor

The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered...

PT-2026-72145

Name of the Vulnerable Software and Affected Versions Propovoice: All-in-One Client Management System versions prior to 1.7.9 Description An issue exists where the REST endpoint of the create function fails to validate the user-supplied role parameter against a list of permitted WordPress roles a...

PT-2026-72164

The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before 13.5.7 does not perform an authorization check on one of its REST read routes, allowing unauthenticated users to disclose a store's feed configuration rules, filters and field mapping and to enumerate the full product catego...

PT-2026-72163

The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered...

PT-2026-72881

Name of the Vulnerable Software and Affected Versions Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! versions prior to 3.7.2 Description Authenticated attackers with contributor-level access and above can achieve remote code execution via the fetc...

PT-2026-72143

Name of the Vulnerable Software and Affected Versions Object Sync for Salesforce versions prior to 2.2.14 Description An unauthenticated SQL Injection exists in the /wp-json/object-sync-for-salesforce/push/ REST endpoint. The issue occurs because the can process permission callback only verifies...

PT-2026-72142

Name of the Vulnerable Software and Affected Versions bLoyal: Loyalty & Promotions by bLoyal versions prior to 3.1.611.79 Description This issue allows authenticated users with Subscriber-level access or higher to escalate their privileges to any WordPress user, including the site Administrator...

GHSA-5FPJ-28RV-84R7 Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

Summary Budibase automation steps outgoing webhook, Zapier, n8n, Slack, Discord, Make.com make server-side HTTP requests to user-provided URLs using node-fetch directly, completely bypassing the IP blacklist protection that exists in the REST API integration. Additionally, the REST API blacklist...

CVE-2026-48528

CVE-2026-48528 affects Metacat versions 2.0.0–3.4.0 and describes an unauthenticated SQL injection in the /cn/v1/object and /cn/v2/object REST endpoints due to unsanitized nodeId input. The backend SQL queries concatenate user input, enabling arbitrary data extraction from PostgreSQL and potentia...

CVE-2026-48528 Metacat has an unauthenticated SQL injection vulnerability

Metacat is data repository software that helps researchers preserve, share, and discover data. Metacat versions 2.0.0 through 3.4.0 contain an unauthenticated SQL injection vulnerability in the /cn/v1/object and /cn/v2/object REST API endpoints due to unsanitized user input that can be passed...

WordPress User Access Manager plugin < 2.3.15 - Unauthenticated Restricted Content Disclosure via REST API vulnerability

Unauthenticated Restricted Content Disclosure via REST API vulnerability discovered by Farid Narimanov in WordPress Plugin User Access Manager versions 2.3.15...

SUSE CVE-2026-73228

Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in restframework/request.py Request.parse passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies...

SUSE CVE-2026-73229

Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's restframework/renderers.py AdminRenderer.render uses overridemethod to simulate GET and directly invokes view.get without view.checkpermissions while rendering an invalid write...

EUVD-2026-58504

Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public...

PT-2026-76555

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.41.3 Description Authenticated users can perform server-side requests to internal services and cloud metadata. This occurs because automation steps for outgoing webhooks, Zapier, n8n, Slack, and Discord use...

PT-2026-75931

Summary Budibase automation steps outgoing webhook, Zapier, n8n, Slack, Discord, Make.com make server-side HTTP requests to user-provided URLs using node-fetch directly, completely bypassing the IP blacklist protection that exists in the REST API integration. Additionally, the REST API blacklist...