EUVD-2026-62269

The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable by unauthenticated users, allowing anyone to read the store's order totals and its vendors' earnings, balance ledgers, and...

EUVD-2026-62267

The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification...

CVE-2026-14287

The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing an unauthenticated attacker to store markup that executes as...

CVE-2026-14825

Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 lacks per-object ownership checks on front-end text settings, allowing contributor+ users to modify quizzes owned by others via IDOR. CVSS 2.7 LOW; no exploitation observed. Upgrade to 11.2.4. https://wpscan.com/vulnerability/fb66cb33-e1...

CVE-2026-14826

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 lacks per-object ownership checks on REST routes, allowing contributor-level users to read other users' quiz notification recipient addresses via IDOR. Exploitation details are not provided. Upgrade to QSM 11.2.4 to remediate.

CVE-2026-14825 Quiz And Survey Master < 11.2.4 - Contributor+ Arbitrary Quiz Text Settings Update via IDOR

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users...

EUVD-2026-62262

The WCFM Marketplace WordPress plugin before 3.8.1 does not verify that a marketplace vendor owns a review before allowing it to be unapproved or deleted, allowing any vendor to modify or permanently delete reviews belonging to other vendors' stores...

EUVD-2026-62266

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including...

EUVD-2026-62265

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users...

EUVD-2026-62263

The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing an unauthenticated attacker to store markup that executes as...

CVE-2026-13173 Eventin < 4.1.21 - Contributor+ User Role and Meta Modification via Speaker Creation

The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creation, allowing users with contributor-level access and above to modify other users' roles and metadata...

CVE-2026-12983 Dinatur <= 1.18 - Unauthenticated SQL Injection via Column Name Injection

The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. The same handler also performs a database table truncation without any authorization check, allowing any unauthenticat...

EUVD-2026-62258

The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including...

CVE-2026-13173

The Eventin WordPress plugin before 4.1.21 lacks capability checks during speaker creation, allowing contributor-level users to modify other users' roles and metadata. CVSS 2.7 LOW (PR:H). No exploitation reported. Upgrade to 4.1.21 to remediate.

EUVD-2026-62261

The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users...

CVE-2026-13175 Eventin < 4.1.21 - Contributor+ Schedule Deletion and Modification via IDOR

The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users...

EUVD-2026-62260

The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts...

EUVD-2026-62259

The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creation, allowing users with contributor-level access and above to modify other users' roles and metadata...

CVE-2026-49431

The ZFS_IOC_SET_PROP ioctl in FreeBSD's OpenZFS component incorrectly validated the calling user, allowing any local user to set the internal "$hasrecvd" metadata flag on datasets, falsely indicating they received properties from a zfs-recv(8) stream. The BDU assessment classifies this as an acce...

CVE-2026-72165

A flaw was found in the mtd: rawnand component of the Linux kernel. The nandselecttarget function contains an incorrect condition check for the 'cs' chip select parameter, allowing it to go out of its intended range. This out-of-bounds access could potentially lead to a system crash, resulting in...