CVE-2026-11355

The DT LMS – elearning WordPress plugin (versions ≤ 1.1) is vulnerable to unauthorized modification of plugin settings due to missing capability checks on multiple AJAX handlers (dtlms_save_poc_settings, dtlms_save_skin_settings, dtlms_save_options_settings). These handlers are registered on the ...

WordPress Widgets for Social Photo Feed <= 1.8 - Information Disclosure

Widgets for Social Photo Feed WordPress plugin = 1.8 contains a broken access control caused by missing capability checks on specific REST API endpoints, letting unauthenticated attackers access and modify plugin settings remotely. id: CVE-2025-14726 info: name: WordPress Widgets for Social Photo...

CVE-2026-65540

CVE-2026-65540 Popup for CF7 with Sweet Alert Hello document.getElementById'csrf'.submit; 2. 管理者として WordPress にログインします 3. 悪意のあるページにアクセスします 4. 任意 http://TARGET/wp-admin/admin.php?page=cf7-simplepopup に移動し、Width フィールドに 500;alertdocument.domain が含まれていることを確認します 5. 任意のフロントエンドページにアクセスすると、ブラウザで...

CVE-2025-31033

⚠️ CVE-2025-31033 - WordPress Buddypress Humanity プラグイン = 1.2 の CSRF 🛡️ 脆弱性の概要 WordPress 用の Buddypress Humanity プラグイン（バージョン = 1.2）は、クロスサイトリクエストフォージェリ（CSRF） に対して脆弱です。 この脆弱性により、攻撃者は権限の高いユーザー（例：管理者）に、セキュリティの質問や回答などのプラグイン設定を意図せず変更させ、ユーザー検証ロジックを回避させることができます。 🐞 脆弱性の種類 クロスサイトリクエストフォージェリ（CSRF）...

CVE-2022-1421

CVE-2022-1421 CVE-2022-1421에 대한 개념 증명PoC Discy 참고 자료 https://wpscan.com/vulnerability/a7a24e8e-9056-4967-bcad-b96cc0c5b249 https://vulners.com/cve/CVE-2022-1421...

CVE-2024-2782-PoC

CVE-2024-2782-PoC CVE-2024-2782 개념 증명Proof-of-Concept WordPress용 퀴즈, 설문조사 및 드래그 앤 드롭 WP Form Builder 플러그인인 Contact Form Plugin by Fluent Forms는 5.1.16 이하의 모든 버전에서 /wp-json/fluentform/v1/global-settings REST API 엔드포인트에 대한 권한capability 검사 누락으로 인해 데이터 무단 수정에 취약합니다. 이로 인해 인증되지 않은 공격자가 플러그인의 모든 설정을 수정...

CVE-2025-15485 Auto x LINE <= 1.0.0 – Unauthenticated REST API Endpoints Call

The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc...

CVE-2025-15485 Auto x LINE <= 1.0.0 – Unauthenticated REST API Endpoints Call

The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc...

EUVD-2026-69622

A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authenticated low privilege operator user to change the state of certain settings of a vulnerable system...

CVE-2026-73740

A local privilege escalation vulnerability in HPE Networking Fabric Composer could allow an authenticated privileged user on the underlying host to elevate their user privileges to those of a higher role. A successful exploit allows the attacker to change the state of certain settings of the...

CVE-2026-73740 Local Privilege Escalation in HPE Networking Fabric Composer

A local privilege escalation vulnerability in HPE Networking Fabric Composer could allow an authenticated privileged user on the underlying host to elevate their user privileges to those of a higher role. A successful exploit allows the attacker to change the state of certain settings of the...

CVE-2026-17587

The My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-17587 My Agile Privacy® <= 3.3.6 - Missing Authorization to Unauthenticated Plugin Settings Modification via map_missing_cookie_shield / map_check_consent_mode_status AJAX Actions

The My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

EUVD-2026-65461

The My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-17587

My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is affected by an authorization bypass in all versions up to and including 3.3.6 . The root cause is missing access-control checks on the map_missing_cookie_shield and map_check_consent_mode_status AJAX actions, allowing...

PT-2026-81266

The My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-5093

The GreenShift – Animation and Page Builder Blocks plugin for WordPress (versions up to and including 12.8.9 ) is vulnerable to unauthorized modification of data due to a missing capability check on the gspb_update_global_wp_settings function. The function only verifies the edit_posts capability ...

CVE-2026-18789

The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently...

PT-2026-66545

Name of the Vulnerable Software and Affected Versions Leantime version 3.6.2 Description An issue exists where the Laravel VerifyCsrfToken middleware is excluded from the global middleware stack in app/Http/Kernel.php. This allows unauthenticated attackers to perform state-changing actions on...

CVE-2026-64813

JetBrains IntelliJ IDEA prior to version 2026.2 contains a vulnerability where unauthorized settings modification is possible during Remote Development sessions. The issue is indicated as a CRITICAL impact (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) with network attack vector, no privileges r...