17815 matches found
EUVD-2026-59758
Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in defaultemailpasswordreset and defaultwelcomesend. Both default emails emit a link of the form $base/login/$code, whose authority comes from the request Host header,...
CVE-2026-15689
Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in defaultemailpasswordreset and defaultwelcomesend. Both default emails emit a link of the form $base/login/$code, whose authority comes from the request Host header,...
CVE-2026-16142
The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the addfrontuserupdate AJAX handler being registered for unauthenticated users and accepting an arbitrary truebookerwpuserid value, which is passed directly to...
CVE-2026-16142
CVE-2026-16142 concerns the TrueBooker WordPress plugin (versions up to 1.2.6). The vulnerability arises because the add_front_user_update() AJAX handler is registered for unauthenticated users and accepts an arbitrary truebooker_wp_user_id, passing it directly to wp_update_user() without authent...
CVE-2026-16142 TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter
The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the addfrontuserupdate AJAX handler being registered for unauthenticated users and accepting an arbitrary truebookerwpuserid value, which is passed directly to...
EUVD-2026-59598
The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the addfrontuserupdate AJAX handler being registered for unauthenticated users and accepting an arbitrary truebookerwpuserid value, which is passed directly to...
CVE-2026-15826
The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppbloginuser function calling absint on the return value of wpinsertuser before performing an iswperror check — when a registration...
CVE-2026-15826 User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter
The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppbloginuser function calling absint on the return value of wpinsertuser before performing an iswperror check — when a registration...
EUVD-2026-59593
The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppbloginuser function calling absint on the return value of wpinsertuser before performing an iswperror check — when a registration...
CVE-2026-18216
The Backup Migration WordPress plugin before 2.1.7 fails to restrict its post-restore auto-login mechanism in multisite deployments. A site admin can trigger a restore on another site in the network, obtaining a long-lived admin session without credentials and bypassing 2FA. CISA flags it as expl...
CVE-2026-15341
The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4.0. The synchronizesession function, hooked on init and therefore executed on every request, performs no nonce, capability, or shared-secr...
EUVD-2026-58842
The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4.0. The synchronizesession function, hooked on init and therefore executed on every request, performs no nonce, capability, or shared-secr...
CVE-2026-15341
The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4.0. The synchronizesession function, hooked on init and therefore executed on every request, performs no nonce, capability, or shared-secr...
CVE-2026-15341 User Session Synchronizer <= 1.4.0 - Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters
The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4.0. The synchronizesession function, hooked on init and therefore executed on every request, performs no nonce, capability, or shared-secr...
CVE-2026-15303 6Storage Rentals <= 2.27.0 - Unauthenticated Account Takeover via 'email' Parameter
The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the sixstoragecreatewpuser AJAX handler being registered on wpajaxnoprivsixstoragecreatewpuser without any nonce, capability, credential, or ownership...
CVE-2026-15303
The CVE pertains to the 6Storage Rentals WordPress plugin (affected versions up to 2.27.0). The vulnerability is an authentication bypass in the six_storage_create_wp_user() AJAX handler, registered on wp_ajax_nopriv_six_storage_create_wp_user without nonce, capability, credential, or ownership v...
CVE-2026-15341
CVE-2026-15341 affects the WordPress plugin User Session Synchronizer (versions up to and including 1.4.0). The vulnerability arises in synchronize_session() (hooked on init) which performs no nonce, capability, or shared-secret validation for attacker-supplied ussync-key, ussync-token, and ussyn...
PT-2026-73031
Name of the Vulnerable Software and Affected Versions Dancer2::Plugin::Auth::Extensible versions prior to 0.714 Description Password reset link poisoning is possible via the request Host header in the default email password reset and default welcome send functions. Both default emails generate a...
PT-2026-72877
Name of the Vulnerable Software and Affected Versions User Profile Builder versions prior to 3.16.5 Description An authentication bypass exists due to type confusion within the wppb log in user function. When a registration request is submitted using the username parameter with a length between 6...
PT-2026-72146
Name of the Vulnerable Software and Affected Versions User Session Synchronizer versions prior to 1.4.1 Description An authentication bypass exists that can lead to account takeover. The synchronize session function, which executes on every request, fails to validate nonces, capabilities, or shar...