CVE-2026-73363 WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce 2.0.8 versions...

CVE-2026-73363

CVE-2026-73363 is an unauthenticated Broken Access Control vulnerability in the WordPress plugin Taxi Booking Manager for WooCommerce (plugin slug: ecab-taxi-booking-manager ), affecting versions prior to 2.0.8 . The flaw allows a low-privileged user to perform unauthorized actions, resulting in ...

EUVD-2026-62383

Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce 2.0.8 versions...

CVE-2026-73394

The WordPress Stitch Express plugin (versions ≤ 1.9.0) has an unauthenticated broken access control flaw exploitable over the network with no credentials (CVSS 7.5, HIGH), allowing unauthorised integrity changes; no patch version or exploit details are provided in the documents.

CVE-2026-73394 WordPress Stitch Express plugin <= 1.9.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Stitch Express = 1.9.0 versions...

EUVD-2026-62371

Unauthenticated Broken Access Control in Stitch Express = 1.9.0 versions...

WordPress Koji theme <= 2.2.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Theme Koji versions = 2.2.1...

Vulnerabilities in Oracle Commerce Platform

Oracle has identified several vulnerabilities in the Oracle Commerce Platform version 11.4.0. These vulnerabilities allow unauthorized attackers with network access to perform critical actions without authentication. This includes gaining unauthorized access to sensitive data, modifying, deleting...

WordPress Stitch Express plugin <= 1.9.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by babyhack@OPCIA in WordPress Plugin Stitch Express versions = 1.9.1...

MINI-8V39-V7X2-9FH3

Bulletin has no description...

CVE-2026-19417

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports...

CVE-2026-19782

The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing any authenticated user, such as a subscriber, to retrieve the email addresses of all registered users...

CVE-2026-19406

The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses...

CVE-2026-19416

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments...

CVE-2026-18776

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow...

CVE-2026-16979

The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before 3.16.3 does not perform capability checks on two of its AJAX actions, allowing users with at least the Subscriber role to read the titles of private and draft posts by ID and to enumerate stored post-meta key names...

CVE-2026-14861

The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification...

CVE-2026-16058

The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable by unauthenticated users, allowing anyone to read the store's order totals and its vendors' earnings, balance ledgers, and...

CVE-2026-14825

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users...

CVE-2026-14826

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including...