CVE-2020-8193

Citrix ADC Vulns CVE List https://support.citrix.com/article/CTX276688 Add if while Code https://dmaasland.github.io/posts/citrix.html responsestr = json.dumpsr.headers.dict'store' if r.statuscode == 406 and "Content-Disposition" in responsestr and r.headers"Accept-Ranges" == "bytes" and...

AntD Admin - Sensitive Information Disclosure

AntD Admin has a security vulnerability that stems from Antd-admin 5.5.0 being affected by an incorrect access control vulnerability. Attackers can exploit this vulnerability to gain unauthorized access to some front-end interfaces, resulting in the leakage of sensitive information such as user...

WordPress BackWPup plugin < 5.7.7 - Unauthenticated Sensitive Data Disclosure vulnerability

Unauthenticated Sensitive Data Disclosure vulnerability discovered by Philipp Doblhofer in WordPress Plugin BackWPup versions 5.7.7...

CVE-2026-86826 BackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Working Directory on NGINX

The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive database dump and site...

CVE-2026-86826

The BackWPup WordPress plugin, in versions before 5.7.7 , fails to properly restrict web access to the working directory utilized during backup restores. On webservers that do not honor .htaccess rules, such as NGINX , unauthenticated attackers can download full backup archives left behind by int...

CVE-2026-97188

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...

CVE-2026-96530 Optimole 4.0.0 - 4.2.14 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget

The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials...

CVE-2026-97188

The String locator WordPress plugin, in versions before 2.6.8 , is vulnerable to an unauthenticated PHP Object Injection vulnerability. The root cause is the failure to restrict allowed classes during the deserialization of database row content saved via the plugin's database editor . This allows...

CVE-2026-96530 Optimole 4.0.0 - 4.2.14 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget

The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials...

CVE-2026-96530

The Optimole WordPress plugin versions prior to 4.2.15 is vulnerable to a sensitive data disclosure. The root cause is a missing capability check before exposing stored image-optimization account data within a dashboard widget. This flaw allows any authenticated user , including those with the lo...

CVE-2026-97188 String Locator < 2.6.8 - Unauthenticated PHP Object Injection via Database Editor

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...

EUVD-2026-94190

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...

CVE-2026-97188: Deserialization of Untrusted Data

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...

PT-2026-107413

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...

CVE-2026-86786 Slider Pro <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via sliderpro_multiple_images

The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the title, excerpt and permalink of non-public posts, including drafts, pending, scheduled, private and trashed posts, as wel...

CVE-2026-86786

The Slider Pro WordPress plugin (versions through 1.0.0 ) is vulnerable to an Unauthenticated Sensitive Data Disclosure due to a lack of capability or authorization checks on one of its AJAX actions. An unauthenticated attacker can exploit this to retrieve the title, excerpt, and permalink of non...

WordPress Slider Pro plugin <= 1.0.0 - Unauthenticated Sensitive Data Disclosure vulnerability

Unauthenticated Sensitive Data Disclosure vulnerability discovered by Seongwon Lee in WordPress Plugin Slider Pro versions = 1.0.0...

CVE-2026-86786 Slider Pro <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via sliderpro_multiple_images

The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the title, excerpt and permalink of non-public posts, including drafts, pending, scheduled, private and trashed posts, as wel...

WordPress Five Star Business Profile and Schema plugin 2.3.20-2.3.21 - Author+ Sensitive Data Disclosure vulnerability

Author+ Sensitive Data Disclosure vulnerability discovered by Artus KG in WordPress Plugin Five Star Business Profile and Schema versions 2.3.20-2.3.21...

CVE-2026-86817

The Five Star Business Profile and Schema WordPress plugin (versions 2.3.20-2.3.21 ) is vulnerable to a sensitive data disclosure flaw. The issue stems from the plugin failing to properly restrict callbacks used to resolve schema field default values. This allows authenticated users with Author-l...