EUVD-2026-66950

Editor Broken Access Control in FluentPlayer Pro = 1.3.2 versions...

CVE-2026-81272

CVE-2026-81272 affects the WordPress FluentPlayer Pro plugin in versions 1.3.2 and below , where an Editor-level Broken Access Control flaw allows a user with the Editor role to perform actions they should not be permitted to. The CVSS 3.1 score is 4.9 (MEDIUM) with the vector AV:N/AC:L/PR:H/UI:N...

CVE-2026-80433 WordPress SureFeedback Client Site plugin <= 1.2.12 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in SureFeedback Client Site = 1.2.12 versions...

CVE-2026-80433

SureFeedback Client Site is a WordPress plugin vulnerable to Subscriber-level Sensitive Data Exposure in versions 1.2.12 and below . The CVSS 3.1 score is 7.5 (High) , with a network attack vector requiring no privileges or user interaction, and a high impact on confidentiality but no impact on i...

CVE-2026-78285 WordPress Like Button Rating plugin <= 2.6.61 - SQL Injection vulnerability

Subscriber SQL Injection in Like Button Rating = 2.6.61 versions...

CVE-2026-78285

WordPress Like Button Rating plugin (versions

EUVD-2026-66937

Editor Arbitrary File Upload in Fluent Boards Pro = 2.0.11 versions...

EUVD-2026-66993

Unauthenticated SQL Injection in Epayco = 8.4.6 versions...

CVE-2026-78257 WordPress Booking and Rental Manager plugin <= 2.7.5 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Booking and Rental Manager = 2.7.5 versions...

CVE-2026-78257

CVE-2026-78257 is a PHP Object Injection vulnerability in the WordPress plugin Booking and Rental Manager for WooCommerce (versions ≤ 2.7.5), discovered by daroo and rated CVSS 8.8 (High) by Patchstack. The flaw allows a user with Contributor privilege to exploit the injection over the network wi...

EUVD-2026-66990

Subscriber SQL Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

CVE-2026-32564

CVE-2026-32564 is a Subscriber-level SQL Injection in the ACPT (Pro) – Custom Post Types Plugin for WordPress (versions ≤ 2.0.63 ), discovered by VDsec. The vulnerability allows a low-privilege (Subscriber) authenticated user to inject SQL, resulting in HIGH confidentiality impact with changed sc...

CVE-2026-32564 WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - SQL Injection vulnerability

Subscriber SQL Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

CVE-2026-27330

An unauthenticated Broken Access Control vulnerability affects the WordPress plugin Mobile App for WooCommerce in versions ≤ 0.4.62 , as reported by researcher Phat RiO and cataloged by Patchstack. The flaw allows a remote attacker with no prior authentication or user interaction to access protec...

CVE-2026-27330 WordPress Mobile App for WooCommerce plugin <= 0.4.62 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Mobile App for WooCommerce = 0.4.62 versions...

EUVD-2026-66987

Unauthenticated Broken Access Control in Mobile App for WooCommerce = 0.4.62 versions...

CVE-2026-81279 WordPress Push Notification for Post and BuddyPress plugin <= 3.20 - Broken Access Control vulnerability

Subscriber Broken Access Control in Push Notification for Post and BuddyPress = 3.20 versions...

EUVD-2026-66986

Subscriber Broken Access Control in Push Notification for Post and BuddyPress = 3.20 versions...

CVE-2026-81279

The WordPress plugin Push Notification for Post and BuddyPress versions

CVE-2026-80558

A flaw was found in libceph within the Linux kernel. A remote attacker, by sending a specially crafted or corrupted OSD map osdmap from a Ceph monitor or OSD, could cause the system to attempt to access memory outside of allocated bounds. This out-of-bounds access occurs because invalid OSD indic...