CVE-2026-57175

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could...

WordPress InfiniteWP Client plugin < 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite vulnerability

Unauthenticated Administrator Account Takeover on Multisite vulnerability discovered by Jakub Herman in WordPress Plugin InfiniteWP Client versions 1.13.6...

CVE-2026-19632

CVE-2026-19632 — TranslatePress ≤ 3.3.1 Unauthenticated Account Takeover PoC Mass account-takeover tool for CVE-2026-19632 , an unauthenticated account takeover in the TranslatePress – Multilingual WordPress plugin ≤ 3.3.1 caused by password reset link disclosure. One command per target list — th...

CVE-2026-82183 OAuth Single Sign On 6.25.0 - 7.0.0 - Unauthenticated Account Takeover via Unverified Steam OpenID Assertion

The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts...

Exploit for CVE-2026-18963

CVE-2026-18963 — Keycloak reset-credentials bypass → unauthent...

CVE-2026-14596 DynamicKit for Elementor < 1.0.3 - Unauthenticated Account Takeover via Password Reset Link Host Injection

The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it emails, allowing unauthenticated attackers to send a target user a legitimately-formatted reset email whose link points to an...

PT-2026-60394

Name of the Vulnerable Software and Affected Versions Zoom Rooms for Windows versions prior to 7.1.0 Description Improper privilege management allows an authenticated user to perform an escalation of privilege through local access. Recommendations Update Zoom Rooms for Windows to version 7.1.0 or...

CVE-2026-32248: Improper Neutralization of Special Elements in Data Query Logic

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.12 and 8.6.38, an unauthenticated attacker can take over any user account that was created with an authentication provider that does not validate the format of the user...

WordPress plugin DWT - Directory & Listing security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WordPress plugin Service Finder Bookings 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in...

CVE-2024-56000 WordPress K Elements plugin < 5.4.0 - Unauthenticated Account Takeover vulnerability

Incorrect Privilege Assignment vulnerability in SeventhQueen K Elements k-elements allows Privilege Escalation.This issue affects K Elements: from n/a through 5.4.0...

CVE-2024-43234 WordPress Woffice theme <= 5.4.14 - Unauthenticated Account Takeover vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in WofficeIO Woffice woffice allows Authentication Bypass.This issue affects Woffice: from n/a through = 5.4.14...

CVE-2024-44000 WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability

Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Authentication Bypass.This issue affects LiteSpeed Cache: from n/a through 6.5.0.1...

CVE-2024-44000

The LiteSpeed Cache plugin for WordPress (versions up to and including 6.5.0.1 ) is vulnerable to Sensitive Information Exposure due to insufficient credential protection. An unauthenticated attacker can access the publicly exposed debug.log file (e.g., /wp-content/debug.log) if the debug feature...

CVE-2024-44000 WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability

Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Authentication Bypass.This issue affects LiteSpeed Cache: from n/a through 6.5.0.1...

WordPress Plugin 'LiteSpeed Cache' < 6.5.0.1. Unauthenticated Account Takeover

The WordPress application running on the remote host has a version of the 'LiteSpeed Cache' plugin that is prior to 6.5.0.1. It is, therefore, affected by an unauthenticated account takeover vulnerability. The plugin suffers from an unauthenticated account takeover vulnerability which allows any...

CVE-2024-43245 WordPress JobSearch plugin <= 2.3.4 - Unauthenticated Account Takeover vulnerability

Improper Privilege Management vulnerability in eyecix JobSearch allows Privilege Escalation.This issue affects JobSearch: from n/a through 2.3.4...

CVE-2024-43245 WordPress JobSearch plugin <= 2.3.4 - Unauthenticated Account Takeover vulnerability

Improper Privilege Management vulnerability in eyecix JobSearch allows Privilege Escalation.This issue affects JobSearch: from n/a through 2.3.4...

CVE-2023-38389 WordPress Jupiter X Core plugin <= 3.3.8 - Unauthenticated Account Takeover vulnerability

Incorrect Authorization vulnerability in Artbees JupiterX Core allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JupiterX Core: from n/a through 3.3.8...

CVE-2023-38389 WordPress Jupiter X Core plugin <= 3.3.8 - Unauthenticated Account Takeover vulnerability

Incorrect Authorization vulnerability in Artbees JupiterX Core allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JupiterX Core: from n/a through 3.3.8...