309 matches found
CVE-2026-66683
Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript = 2.0.16 versions...
CVE-2026-66684
Unauthenticated Sensitive Data Exposure in Export Import Menus = 1.9.2 versions...
CVE-2026-66683 WordPress Custom CSS and JavaScript plugin <= 2.0.16 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript = 2.0.16 versions...
CVE-2026-67531 FrontMCP: CodeCall sandbox escape -> host RCE via live Zod schema exposure by getTool
FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool, and because Zod v4 defines zod as a non-configurable, non-writable own property, the ECMAScript Proxy...
CVE-2026-71316 Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients
Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for //payload.json can be returned before route middleware and page guards because import.meta.prerender is not enforced, disclosing another user's SSR data. This issue is fixed...
WordPress AI Copilot – Content Generator plugin <= 1.4.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability
Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability discovered by Kazuma Matsumoto in WordPress Plugin AIWU versions = 1.4.6...
CVE-2026-71204
The CVE-2026-71204 entry concerns changedetection.io. A POST to /settings that omits api_access_token_enabled causes the update logic to silently disable API key enforcement because WTForms treats unchecked checkboxes as False and only the password field is specially handled. This results in the ...
CVE-2026-71204
changedetection.io's /settings save handler builds an update dict from form.data'application' and blind-merges it into the stored application settings via .update. Because WTForms represents an unchecked checkbox as False rather than 'unchanged', and only the 'password' field is special-cased...
CVE-2026-15236
The CVE-2026-15236 affects the Gallery for Google Photos WordPress plugin: versions before 1.2.1 do not properly restrict access to stored third‑party OAuth credentials, exposing persistent access and refresh tokens to unauthenticated users and enabling long‑term compromise of the linked account....
CVE-2026-62959
Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location...
CVE-2026-16773 WPBot <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.5.9 via the wpbotsendemailtranscriptfree. This makes it possible for unauthenticated attackers to exfiltrate full chat...
CVE-2026-16773 WPBot <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.5.9 via the wpbotsendemailtranscriptfree. This makes it possible for unauthenticated attackers to exfiltrate full chat...
WordPress WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action vulnerability
Unauthenticated Sensitive Information Exposure in 'wpbotsendemailtranscript' AJAX Action vulnerability discovered by Wordfence PRISM in WordPress Plugin ChatBot versions = 8.5.9...
WordPress Demi – One Click Demo Import, Backup & Site Migration plugin <= 0.0.8 - Unauthenticated Information Exposure to Arbitrary Directory Copy vulnerability
Unauthenticated Information Exposure to Arbitrary Directory Copy vulnerability discovered by SAHRAOUI AYMEN in WordPress Plugin Demi One Click Demo Import, Backup & Site Migration versions = 0.0.8...
CVE-2026-66438
Unauthenticated Sensitive Data Exposure in Exclusive Addons Elementor = 2.8.0 versions...
CVE-2026-65564
Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress = 2.97.6 versions...
CVE-2026-59548
Unauthenticated Sensitive Data Exposure in Byteflows Travel & Hotel Booking = 1.0.0 versions...
CVE-2026-59529
Unauthenticated Sensitive Data Exposure in Ebook Store = 6.19 versions...
