59621 matches found
CVE-2026-14849
The CVE-2026-14849 entry concerns the Paid Membership Subscriptions WordPress plugin (before 3.0.7). Affected component: member and payment export files written to a predictable location in the uploads directory. Root cause: lack of protection allows unauthenticated users to download these export...
CVE-2026-14834 Mailgun for WordPress < 2.2.1 - Unauthenticated Arbitrary Mailgun List Subscription via add_list AJAX
The Mailgun for WordPress plugin before 2.2.1 does not perform any capability or nonce check on an unauthenticated AJAX action that adds subscribers to the site owner's configured email service mailing lists, allowing unauthenticated attackers to enrol arbitrary email addresses into those lists...
CVE-2026-14849
The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in the uploads directory, allowing unauthenticated users to download the exported member and payment data including PII while an export artifact...
CVE-2026-14849 Paid Member Subscriptions < 3.0.7 - Unauthenticated Sensitive Information Exposure via Residual Export Files
The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in the uploads directory, allowing unauthenticated users to download the exported member and payment data including PII while an export artifact...
CVE-2026-14843
The CVE concerns the WordPress plugin Events Made Easy prior to version 3.1.4 . The vulnerability arises because the plugin does not verify that the requester is authorized to modify a targeted record during an unauthenticated data-change request; it relies on a public nonce with no per-record to...
CVE-2026-14834
The CVE applies to the Mailgun for WordPress plugin prior to version 2.2.1. An unauthenticated AJAX action (listed as add_list) does not perform capability or nonce checks, permitting unauthenticated attackers to enrol arbitrary email addresses into the site owner’s configured Mailgun mailing lis...
CVE-2026-14333 Demi - One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticated Sensitive Data Exposure via Public Backup Directory
The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes...
CVE-2026-14830
The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually paid before marking the associated order as paid, allowing unauthenticated attackers to complete WooCommerce orders without paying...
CVE-2026-14333
The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes...
CVE-2026-14333
CVE-2026-14333 affects the Demi WordPress plugin (before 0.0.7). The vulnerability arises because full-site backup archives are stored in a publicly accessible location with a predictable filename and without access protection. This enables unauthenticated attackers to download complete backups, ...
CVE-2026-14319 GiveWP < 4.16.3 - Unauthenticated Recurring Donor Information Disclosure
The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing unauthenticated users to retrieve information about anonymous recurring donors, including their name and subscription details...
CVE-2026-14317
The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, which allows unauthenticated users to complete donations through a payment gateway the administrator has disabled...
CVE-2026-14317 GiveWP < 4.16.3 - Unauthenticated Payment Gateway Restriction Bypass
The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, which allows unauthenticated users to complete donations through a payment gateway the administrator has disabled...
CVE-2026-14319
The CVE-2026-14319 entry concerns the GiveWP WordPress plugin prior to version 4.16.3. A REST API endpoint does not properly restrict access, allowing unauthenticated users to retrieve recurring-donation records, including names and subscription details of anonymous donors. Root cause is insuffic...
EUVD-2026-51406
DMS+ Non-Mobile developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control over all installed DMS+ devices...
CVE-2026-18452 Rich Source｜DMS+ (Non-Mobile) - Use of Hard-coded Credentials
DMS+ Non-Mobile developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control over all installed DMS+ devices...
CVE-2026-56673 ComfyUI: Path traversal in LoadImage via the /prompt API allows arbitrary file existence probing and image exfiltration
ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node interface. Prior to 0.28.0, folderpaths.getannotatedfilepath and existsannotatedfilepath join workflow-controlled annotated filenames to a base directory without a containment check, allowing an unauthenticated craft...
CVE-2026-56671
ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, getmodelpreview in app/modelmanager.py joins an unrestricted filename route capture to a selected model directory without a containment check, allowing an unauthenticated remote attacker to us...
EUVD-2026-51401
ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, getmodelpreview in app/modelmanager.py joins an unrestricted filename route capture to a selected model directory without a containment check, allowing an unauthenticated remote attacker to us...
